CVE-2025-59430

HIGH 8.2EPSS 0.5%

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2.

CVSS v3.1: 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
CVSS v3.1: 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
EPSS: 0.47% chance of exploitation in the next 30 days, 39th percentile
Published: 2025-09-22

Proof-of-concept exploits (1)

advisories/GHSA-vh3f-qppr-j97f

References

CVE Record
NVD entry

CVE-2025-59430

Proof-of-concept exploits (1)

References

Related