Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@meshconnect/web-link-sdk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2npmAmendedPublished

    Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink

    CVE-2025-59430 · GHSA-vh3f-qppr-j97f

    Affected
    • npm @meshconnect/web-link-sdk < 3.3.2
    Fixed in
    3.3.2· Vendor fix available
    Issue
    The lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. Details https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441 The createLink.openLink function takes base64 encoded links, decodes them, and then sets the resulting string as the src attribute of an iframe. It’s important to note that the protocol part is not validated, so a payload, which is a valid URL, such as javascript:alert(document.domain)//, can be provided to the function. PoC 1. Extract poc-mesh-web-sdk.zip 2. Run yarn install and then yarn start 3. Paste this payload inside the input box: amF2YXNjcmlwdDphbGVydCh3aW5kb3cucGFyZW50LmRvY3VtZW50LmJvZHkuZ2V0RWxlbWVudHNCeVRhZ05hbWUoImgyIikuaXRlbSgwKVsiaW5uZXJIVE1MIl0pLy8= 4. Click on the OpenLink button 5. Notice the alert box and ability to access the h2 title from the parent page It can also…

    Recommended action: Upgrade to 3.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →