CVE-2025-59430

Description

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2.

PUBLISHED Reserved 2025-09-15 | Published 2025-09-22 | Updated 2025-09-22 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...eb-sdk/security/advisories/GHSA-vh3f-qppr-j97f

github.com/FrontFin/mesh-web-sdk/pull/124

github.com/...ommit/7f22148516d58e21a8b7670dde927d614c0d15c2

github.com/...e46d6cb14695474924e7/packages/link/src/Link.ts

cve.org (CVE-2025-59430)

nvd.nist.gov (CVE-2025-59430)

Download JSON