Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Fix availableCritical · CVSS 9.3EPSS 0.13%

Published Oct 2, 2026 · updated Oct 2, 2026

What to do

  1. Upgrade to a fixed version: @a2ui/web_core 0.10.2.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npm@a2ui/web_core569,079 downloads/week

Vulnerable versions
>= 0.9.0, < 0.10.2
Fixed in
0.10.2

Check your project: npm ls @a2ui/web_core --all

Is @a2ui/web_core@0.10.2 safe to install? See the upgrade verdict →

Sources

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

← All critical vulnerabilities