Read the docs
TI-2019-00192 Aliases CVE-2019-0219GHSA-c6pw-q7f2-97hv

Cross-site scripting in Apache Cordova

Priority MEDIUM 53CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.

Why it matters now

EPSS 0.0783 94th percentileScored 2026-11-07
Fix Fixed cordova-plugin-inappbrowser (npm): 3.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheCordovaCordova Android applications using the InAppBrowser plugin ( cordova-plugin-inappbrowser version 3.0.0 and below )—No fix listedCNA
—cordova-plugin-inappbrowser (npm)before 3.1.03.1.0Patch availableGHSA-c6pw-q7f2-97hv
  • Cordova VendorApache Affected Cordova Android applications using the InAppBrowser plugin ( cordova-plugin-inappbrowser version 3.0.0 and below ) Fixed in — No fix listed CNA
  • cordova-plugin-inappbrowser (npm) Vendor— Affected before 3.1.0 Fixed in 3.1.0 Patch available GHSA-c6pw-q7f2-97hv

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:apache:cordova_inappbrowser:*:*:*:*:*:android:*:*up to 3.0.0VulnerableApache
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*17.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*17.2VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*17.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*16.0.6VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*17.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*18.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*19.0.2VulnerableOracle
  • cpe:2.3:a:apache:cordova_inappbrowser:*:*:*:*:*:android:*:* Versions up to 3.0.0 Vulnerable ·Apache
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-c6pw-q7f2-97hv cordova-plugin-inappbrowser (npm) Fixed in 3.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0219
  2. 2026-10-03 Alias added: GHSA-c6pw-q7f2-97hv

References

Patch 2

Advisory 4

Other 3

  • TI-2026-34993 Improper input validation in Apache Cordova Plugin InAppBrowser CVSS 4.0CRITICAL 9.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences