The openUrl function in the @a2ui/web_core library forwards a URL supplied by the agent directly to window.open() without validating the URI scheme. A malicious agent can construct a javascript: URI and embed it as the url argument of a Button component’s functionCall action. When the user clicks the rendered button, the malicious code runs in the context of the victim application, enabling arbitrary JavaScript execution in the browser origin. This constitutes an XSS vulnerability that can be stored (persisted in the component configuration) or reflected (contained in a user‑supplied input).

Projects that rely on the Google‑maintained @a2ui/web_core component are vulnerable. The flaw applies to all installations that enable the Basic Catalog, which is turned on by default, and no specific product versions are disclosed in the advisory.

The CVSS score of 6.1 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in CISA KEV. The flaw does not require any special configuration changes; an attacker can trigger the XSS by inserting a javascript: URI into a Button component’s configuration and forcing a user to click it. The attack vector is therefore user interaction via a rendered button, making exploitation realistic in environments where the library is used without additional safeguards.