{"id":"CVE-2025-59430","sourceIdentifier":"security-advisories@github.com","published":"2025-09-22T19:16:23.330","lastModified":"2026-10-11T21:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2."},{"lang":"es","value":"Mesh Connect JS SDK contiene bibliotecas JS para la integración con Mesh Connect. Antes de la versión 3.3.2, la falta de saneamiento de los protocolos de URL en la función createLink.openLink permite la ejecución de código JavaScript arbitrario dentro del contexto de la página padre. Esto es técnicamente indistinguible de una página real a nivel de renderizado y permite el acceso al DOM, el almacenamiento, la sesión y las cookies de la página padre. Si el atacante puede especificar customIframeId, pueden secuestrar la fuente de iframes existentes. Este problema ha sido parcheado en la versión 3.3.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"FrontFin","product":"mesh-web-sdk","versions":[{"version":"< 3.3.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-22T19:43:29.134727Z","id":"CVE-2025-59430","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441","source":"security-advisories@github.com"},{"url":"https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2","source":"security-advisories@github.com"},{"url":"https://github.com/FrontFin/mesh-web-sdk/pull/124","source":"security-advisories@github.com"},{"url":"https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f","source":"security-advisories@github.com"}]}