CVE-2026-103922Published

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

cve-program · CVE-2026-103922

Published

capacitor

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "ionic-team",
                    "product": "capacitor",
                    "versions": [
                        {
                            "version": ">= 6.0.0, < 6.2.2",
                            "status": "affected"
                        },
                        {
                            "version": ">= 7.0.0, < 7.6.9",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.0.0, < 8.3.5",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.3.5, < 8.4.3",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.5.0, < 8.5.1",
                            "status": "affected"
                        }
                    ]
                }

android

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@capacitor",
                    "product": "android",
                    "versions": [
                        {
                            "version": ">= 8.5.0, < 8.5.1",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.3.5, < 8.4.3",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.0.0, < 8.3.5",
                            "status": "affected"
                        },
                        {
                            "version": ">= 7.0.0, < 7.6.9",
                            "status": "affected"
                        },
                        {
                            "version": ">= 6.0.0, < 6.2.2",
                            "status": "affected"
                        }
                    ]
                }

ios

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@capacitor",
                    "product": "ios",
                    "versions": [
                        {
                            "version": ">= 8.5.0, < 8.5.1",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.3.5, < 8.4.3",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.0.0, < 8.3.5",
                            "status": "affected"
                        },
                        {
                            "version": ">= 7.0.0, < 7.6.9",
                            "status": "affected"
                        },
                        {
                            "version": ">= 6.0.0, < 6.2.2",
                            "status": "affected"
                        }
                    ]
                }

core

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "com.capacitorjs",
                    "product": "core",
                    "versions": [
                        {
                            "version": ">= 8.5.0, < 8.5.1",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.3.5, < 8.4.3",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.0.0, < 8.3.5",
                            "status": "affected"
                        },
                        {
                            "version": ">= 7.0.0, < 7.6.9",
                            "status": "affected"
                        },
                        {
                            "version": ">= 6.0.0, < 6.2.2",
                            "status": "affected"
                        }
                    ]
                }

github.com/ionic-team/capacitor-swift-pm

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "swift",
                    "product": "github.com/ionic-team/capacitor-swift-pm",
                    "versions": [
                        {
                            "version": ">= 8.5.0, < 8.5.1",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.3.5, < 8.4.3",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.0.0, < 8.3.5",
                            "status": "affected"
                        },
                        {
                            "version": ">= 7.0.0, < 7.6.9",
                            "status": "affected"
                        },
                        {
                            "version": ">= 6.0.0, < 6.2.2",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-90973

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Oct 1, 2026, 5:27:05 PM

dateUpdated: Oct 1, 2026, 6:01:54 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-103922

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-346 · CWE-441

Original publisher date fields

published: 2026-10-01T18:17:12.840

lastModified: 2026-10-02T18:44:11.270

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-rvm3-566m-v7fv

Published

@capacitor/android

npm

SEMVER · introduced 6.0.0 → fixed 6.2.2

@capacitor/android

npm

SEMVER · introduced 7.0.0 → fixed 7.6.9

@capacitor/ios

npm

SEMVER · introduced 6.0.0 → fixed 6.2.2

@capacitor/ios

npm

SEMVER · introduced 7.0.0 → fixed 7.6.9

github.com/ionic-team/capacitor-swift-pm

SwiftURL

SEMVER · introduced 6.0.0 → fixed 6.2.2

github.com/ionic-team/capacitor-swift-pm

SwiftURL

SEMVER · introduced 7.0.0 → fixed 7.6.9

com.capacitorjs:core

Maven

ECOSYSTEM · introduced 6.0.0 → fixed 6.2.2

6 explicitly affected versions

6.0.0, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.2.1

com.capacitorjs:core

Maven

ECOSYSTEM · introduced 7.0.0 → fixed 7.6.9

20 explicitly affected versions

7.0.0, 7.0.1, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.2, 7.4.3, 7.4.4, 7.4.5, 7.5.0, 7.6.0, 7.6.1, 7.6.2, 7.6.3, 7.6.4, 7.6.5, 7.6.6, 7.6.7, 7.6.8

@capacitor/android

npm

SEMVER · introduced 8.5.0 → fixed 8.5.1

@capacitor/ios

npm

SEMVER · introduced 8.5.0 → fixed 8.5.1

github.com/ionic-team/capacitor-swift-pm

SwiftURL

SEMVER · introduced 8.5.0 → fixed 8.5.1

com.capacitorjs:core

Maven

ECOSYSTEM · introduced 8.5.0 → fixed 8.5.1

1 explicitly affected versions

8.5.0

com.capacitorjs:core

Maven

ECOSYSTEM · introduced 8.3.5 → fixed 8.4.3

3 explicitly affected versions

8.4.0, 8.4.1, 8.4.2

@capacitor/android

npm

SEMVER · introduced 8.3.5 → fixed 8.4.3

@capacitor/ios

npm

SEMVER · introduced 8.3.5 → fixed 8.4.3

github.com/ionic-team/capacitor-swift-pm

SwiftURL

SEMVER · introduced 8.3.5 → fixed 8.4.3

github.com/ionic-team/capacitor-swift-pm

SwiftURL

SEMVER · introduced 8.0.0 → last_affected 8.3.4

com.capacitorjs:core

Maven

ECOSYSTEM · introduced 8.0.0 → last_affected 8.3.4

10 explicitly affected versions

8.0.0, 8.0.1, 8.0.2, 8.1.0, 8.2.0, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.3.4

@capacitor/android

npm

SEMVER · introduced 8.0.0 → last_affected 8.3.4

@capacitor/ios

npm

SEMVER · introduced 8.0.0 → last_affected 8.3.4

Original source record · Cite this exact observation · Complete original publisher JSON