Read the docs
TI-2018-15285 Aliases CVE-2018-25058GHSA-m688-cx2p-rgq9

Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing

Priority LOW 28CWE-1022Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 is able to address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.

Why it matters now

EPSS 0.00562 46th percentileScored 2026-11-07
Fix Fixed twitter-fetcher-js (npm): 18.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Twitter-Post-Fetcher17.x—No fix listedCNA
—twitter-fetcher-js (npm)before 18.0.018.0.0Patch availableGHSA-m688-cx2p-rgq9
  • Twitter-Post-Fetcher Vendor— Affected 17.x Fixed in — No fix listed CNA
  • twitter-fetcher-js (npm) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-m688-cx2p-rgq9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:twitter-post-fetcher_project:twitter-post-fetcher:*:*:*:*:*:*:*:*before 18.0.0VulnerableTwitter-post-fetcher Project
  • cpe:2.3:a:twitter-post-fetcher_project:twitter-post-fetcher:*:*:*:*:*:*:*:* Versions before 18.0.0 Vulnerable ·Twitter-post-fetcher Project

Remediation

  • Fix · GHSA-m688-cx2p-rgq9 twitter-fetcher-js (npm) Fixed in 18.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-25058
  2. 2026-10-03 Alias added: GHSA-m688-cx2p-rgq9

References

Patch 2

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences