CVE-2026-112148: XSS
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
LIFF applications using LIFF SDK versions 2.20.0 through 2.31.0 are affected. The issue executes script in the origin of the affected LIFF application's endpoint.
What user interaction is required for exploitation?
An attacker must cause a user to open a specially crafted URL in an external browser. Successful exploitation can expose JavaScript-accessible authentication tokens or application data, or enable actions using the user's session.