TI-2022-08576 Aliases CVE-2022-24762 GHSA-4vvg-x86p-mvqc

Exposure of Sensitive Information to an Unauthorized Actor in sysend.js

LOW 30CWE-200Published 2022-03-14 · Updated 2024-09-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-346.

Summary

sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00684 52nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed sysend.js (jcubic): 1.10.0sysend (npm): 1.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jcubic	sysend.js	before 1.10.0	1.10.0	Patch available	CNA
—	sysend (npm)	before 1.10.0	1.10.0	Patch available	GHSA-4vvg-x86p-mvqc

sysend.js Vendorjcubic Affected before 1.10.0 Fixed in 1.10.0 Patch available CNA
sysend (npm) Vendor— Affected before 1.10.0 Fixed in 1.10.0 Patch available GHSA-4vvg-x86p-mvqc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sysend.js_project:sysend.js::::::node.js::*	before 1.10.0	Vulnerable	Sysend.js Project

cpe:2.3:a:sysend.js_project:sysend.js:*:*:*:*:*:node.js:*:* Versions before 1.10.0 Vulnerable ·Sysend.js Project

Remediation

Fix · CNA sysend.js (jcubic) Fixed in 1.10.0
Fix · GHSA-4vvg-x86p-mvqc sysend (npm) Fixed in 1.10.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-24762
2026-10-03 Alias added: GHSA-4vvg-x86p-mvqc

References

Exploit 1

https://github.com/jcubic/sysend.js/issues/33

Patch 1

https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431a

Advisory 3

Other 1

https://github.com/jcubic/sysend.js

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences