{"id":"CVE-2026-112148","kind":"vulnerability","aliases":["CVE-2026-112148"],"related":[],"title":"LIFF SDK: DOM XSS via crafted URL exposes tokens and session actions","description":"A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.","summary":"LIFF SDK versions 2.20.0 through 2.31.0 contain a DOM-based cross-site scripting flaw. A user who opens a specially crafted URL in an external browser can have attacker JavaScript run in the origin of the LIFF application endpoint, which can expose JavaScript-accessible authentication tokens or application data, or perform actions with the user's session.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","liff","line","package"],"not_affected_if":["no-liff-sdk","unaffected-version"],"how_to_check":"- Check the installed LIFF SDK version in the project's `package.json` or lockfile for `@line/liff` and see whether it falls between `2.20.0` and `2.31.0`.\n- Search the front-end bundle for the LIFF SDK version string if the dependency is loaded from a CDN.","fix":"- Upgrade the LIFF SDK (`@line/liff`) to a version later than `2.31.0`; the exact fixed version is unknown from the sources.\n- Until upgraded, review LIFF endpoint pages for DOM sinks that read URL parameters and render them as HTML.","status":"open","published_at":"2026-10-20T07:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:29:06+00:00","updated_at":"2026-10-25T04:29:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:29:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the LIFF SDK (`@line/liff`) to a version later than `2.31.0`; the exact fixed version is unknown from the sources.\n- Until upgraded, review LIFF endpoint pages for DOM sinks that read URL parameters and render them as HTML.","reach":"internet","title":"LIFF SDK: DOM XSS via crafted URL exposes tokens and session actions","impact":"medium","summary":"LIFF SDK versions 2.20.0 through 2.31.0 contain a DOM-based cross-site scripting flaw. A user who opens a specially crafted URL in an external browser can have attacker JavaScript run in the origin of the LIFF application endpoint, which can expose JavaScript-accessible authentication tokens or application data, or perform actions with the user's session.","category":"package","nicknames":[],"who_cares":["liff","line","javascript","frontend"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker script runs in the app origin, reads tokens or acts as the user","analyst_note":"Find the fixed LIFF SDK version and the vendor advisory for the affected URL parameter, since the sources only give the NVD entry.","how_to_check":"- Check the installed LIFF SDK version in the project's `package.json` or lockfile for `@line/liff` and see whether it falls between `2.20.0` and `2.31.0`.\n- Search the front-end bundle for the LIFF SDK version string if the dependency is loaded from a CDN.","needs_analyst":true,"not_affected_if":["unaffected-version","no-liff-sdk"],"who_is_affected":"Applications built on the LIFF SDK in the affected version range that open LIFF endpoints in an external browser and handle URL parameters on the client. Teams not using the LIFF SDK, or using versions outside 2.20.0 to 2.31.0, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":3384,"output_tokens":688,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112148':15A,18A '-2026':14A,17A '2.20.0':27B,93C '2.31.0':29B,95C 'access':70B,143C 'action':12A,78B,151C 'affect':119C 'allow':107C 'applic':63B,74B,121C,147C 'arbitrari':112C 'attack':54B,109C 'authent':71B,144C 'base':34B,100C 'browser':51B,135C 'contain':30B 'craft':6A,46B,130C 'cross':36B,102C 'cross-sit':35B,101C 'cve':13A,16A 'data':75B,148C 'disclosur':139C 'dom':3A,33B,99C 'dom-bas':32B,98C 'endpoint':64B,123C 'execut':111C 'expos':8A,67B 'extern':50B,134C 'flaw':39B,106C 'frontend':19B 'identifi':88C 'javascript':20B,55B,69B,113C,142C 'javascript-access':68B,141C 'lead':137C 'liff':1A,21B,24B,62B,90C,120C 'line':22B 'open':43B,127C 'origin':59B,116C 'packag':23B 'perform':77B 'potenti':136C 'run':56B 'script':38B,104C 'sdk':2A,25B,91C 'session':11A,83B,156C 'site':37B,103C 'special':45B,129C 'token':9A,72B,145C 'unauthor':150C 'url':7A,47B,131C 'use':152C 'user':41B,81B,126C,154C 'version':26B,92C 'via':5A 'vulner':85C 'xss':4A,105C","nicknames":[],"mitigations":[],"who_affected":"Applications built on the LIFF SDK in the affected version range that open LIFF endpoints in an external browser and handle URL parameters on the client. Teams not using the LIFF SDK, or using versions outside 2.20.0 to 2.31.0, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dl_cve@linecorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112148","severity":null,"published_at":"2026-10-20T07:17:09+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}