Live › vulnerability › CVE-2026-112148
Go to dashboardLIFF SDK versions 2.20.0 through 2.31.0 contain a DOM-based cross-site scripting flaw. A user who opens a specially crafted URL in an external browser can have attacker JavaScript run in the origin of the LIFF application endpoint, which can expose JavaScript-accessible authentication tokens or application data, or perform actions with the user's session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on the LIFF SDK in the affected version range that open LIFF endpoints in an external browser and handle URL parameters on the client. Teams not using the LIFF SDK, or using versions outside 2.20.0 to 2.31.0, can skip it.
No product ranges from the sources yet.
package.json or lockfile for @line/liff and see whether it falls between 2.20.0 and 2.31.0.@line/liff) to a version later than 2.31.0; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.
This page as .md · .json · in your agent: get_signal("CVE-2026-112148")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.