Liff Sdk
Monthly
DOM-based cross-site scripting in LIFF SDK 2.20.0 through 2.31.0 allows unauthenticated remote attackers (CVSS PR:N) to execute arbitrary JavaScript in the origin of a LIFF application's endpoint when a victim opens a specially crafted URL in an external browser, which can disclose JavaScript-accessible authentication tokens or application data and permit unauthorized actions under the victim's session. Exploitation is not drive-by: it demands that the targeted user actively open the attacker-supplied link, and the vulnerable code path is specific to the external-browser context rather than the in-app LINE client, so real-world exposure is materially narrower than a plain network attack vector implies. Only two vendor references were supplied (the LINE security advisory page and GitHub advisory GHSA-wppr-qmp4-w627); no public exploit code and no active exploitation were identified at time of analysis.
DOM-based cross-site scripting in LIFF SDK 2.20.0 through 2.31.0 allows unauthenticated remote attackers (CVSS PR:N) to execute arbitrary JavaScript in the origin of a LIFF application's endpoint when a victim opens a specially crafted URL in an external browser, which can disclose JavaScript-accessible authentication tokens or application data and permit unauthorized actions under the victim's session. Exploitation is not drive-by: it demands that the targeted user actively open the attacker-supplied link, and the vulnerable code path is specific to the external-browser context rather than the in-app LINE client, so real-world exposure is materially narrower than a plain network attack vector implies. Only two vendor references were supplied (the LINE security advisory page and GitHub advisory GHSA-wppr-qmp4-w627); no public exploit code and no active exploitation were identified at time of analysis.