VulnSocial

CVE-2026-112148

LOWCVSS 5.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-27: 210-27
Referenced assets1 URL
Full discourse2 posts
  • PunPun (Rest ไม่ตอบ=กลับดาวแมว)@punpun_sm

    เย่มไปเลยแอพไลน์ อย่าไปลืมอัพเดท LIFF SDK กันจะจัฟ DOM-based XSS in Line LIFF / Line Mini App CVE-2026-112148

    0000046
    946 followersView on X
  • NEXSIGHT@NEXSIGHTNEWS

    LINEヤフーの「LIFF SDK」にXSSの脆弱性 — 2.20.0〜2.31.0が影響、修正版2.31.1への更新をJVNが案内 https://cyber.nexsight.co/articles/2026/10/27/liff-sdk-xss-cve-2026-112148-jvn-2026-10-27/

    0000064
    91 followersView on X

Explore more

Back to dashboard