CVE-2026-109131: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Red Hat Red Hat Ansible Automation Platform 2

The vulnerability exists in the Hub collection module documentation renderer of the unified Ansible Automation Platform UI, specifically in the formatPartURL function within DocumentationParsers.tsx. It renders documentation URLs as links without restricting the URL protocol or scheme. Consequently, a collection containing a documentation link with a script-executing URL scheme can cause stored cross-site scripting. When another authenticated user views and activates this link, the script runs in the same origin as the Hub UI. This affects the shipped Platform UI code in the 2.6 and 2.7 release branches.

An attacker who can insert a malicious collection documentation link with a script-executing URL scheme can cause script execution in the context of the Ansible Automation Platform UI for other authenticated users. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). The vulnerability requires user interaction (activation of the link) and privileges (authenticated user).

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-109131 for current remediation guidance. Until a fix is applied, avoid viewing or activating untrusted collection documentation links in the Hub UI. Monitor the vendor advisory for updates on official fixes or mitigations.