« Volver al listado

CVE-2025-59430

Estado: AplazadaAlta (8.2)—

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS en JS SDK (CWE-79, falta sanitización de URLs) permite ejecución de JavaScript arbitrario en contexto del navegador padre; acceso a DOM, almacenamiento y cookies confirma impactos de data exfiltration.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingRestrict Web-Based ContentUpdate SoftwareActive Directory ConfigurationRestrict File and Directory PermissionsPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mesh Connect — JS SDKAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-59430",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59430",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-22T19:43:29.134727Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "FrontFin",
          "product": "mesh-web-sdk",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.3.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-09-22T19:16:23.330",
  "references": [
    {
      "url": "https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/FrontFin/mesh-web-sdk/pull/124",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2."
    },
    {
      "lang": "es",
      "value": "Mesh Connect JS SDK contiene bibliotecas JS para la integración con Mesh Connect. Antes de la versión 3.3.2, la falta de saneamiento de los protocolos de URL en la función createLink.openLink permite la ejecución de código JavaScript arbitrario dentro del contexto de la página padre. Esto es técnicamente indistinguible de una página real a nivel de renderizado y permite el acceso al DOM, el almacenamiento, la sesión y las cookies de la página padre. Si el atacante puede especificar customIframeId, pueden secuestrar la fuente de iframes existentes. Este problema ha sido parcheado en la versión 3.3.2."
    }
  ],
  "lastModified": "2026-10-01T16:10:00.257",
  "sourceIdentifier": "security-advisories@github.com"
}