CVE-2025-59430HIGH 8.2EPSS p34.9%

CVE-2025-59430CVE-2025-59430

Description

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2.

Scoring

CVSS 3.18.2 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
EPSS0.44% probability of exploitation · percentile 34.9% · 2026-06-18T12:00:27Z
Published2025-09-22
Last modified2026-04-15

Underlying weaknesses· 1

CWE-79

References

  1. https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441
  2. https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2
  3. https://github.com/FrontFin/mesh-web-sdk/pull/124
  4. https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')cwe-790%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-55346
CVE
CVE-2026-45323
CVE
CVE-2026-35466
CVE
JQuery Cross-Site Scripting (XSS) Vulnerability
CVE
Meta React Server Components Remote Code Execution Vulnerability
CVE
CVE-2025-53967
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.