Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-59430 · Microsoft / collected KEV context

EUVD-2025-30451

GHSA-vh3f-qppr-j97f

cve-program · CVE-2025-59430

• https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f
• https://github.com/FrontFin/mesh-web-sdk/pull/124
• https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2
• https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441

euvd · EUVD-2025-30451

• https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f
• https://github.com/FrontFin/mesh-web-sdk/pull/124
• https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2
• https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441

nvd · CVE-2025-59430

• https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441
• https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2
• https://github.com/FrontFin/mesh-web-sdk/pull/124
• https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f

osv · GHSA-vh3f-qppr-j97f

• https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f
• https://nvd.nist.gov/vuln/detail/CVE-2025-59430
• https://github.com/FrontFin/mesh-web-sdk/pull/124
• https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2
• https://github.com/FrontFin/mesh-web-sdk
• https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441

No related operational record is retained in the current change model.