Read the docs
TI-2026-76747 Aliases CVE-2026-112148

DOM-based cross-site scripting in LY Corporation LIFF SDK

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

LY Corporation LIFF SDK from 2.20.0 before 2.31.1 contains a DOM-based cross-site scripting flaw (CWE-79) in which a crafted URL can make the page run attacker-supplied JavaScript. An attacker needs a user to open the crafted URL in an external browser, and the impact could include disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix Fixed LIFF SDK (LY Corporation): 2.31.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LY CorporationLIFF SDK2.20.0 to before 2.31.12.31.1Patch availableCNA
  • LIFF SDK VendorLY Corporation Affected 2.20.0 to before 2.31.1 Fixed in 2.31.1 Patch available CNA

Remediation

Update LY Corporation LIFF SDK to version 2.31.1, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA LIFF SDK (LY Corporation) Fixed in 2.31.1

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112148
  2. 2026-10-20 Weakness changed · CISA ADP
  3. 2026-10-20 CISA SSVC decision points changed

References

Other 2

  • TI-2026-10143 Hard-coded credentials in LY Corporation Central Dogma CVSS 4.0CRITICAL 9.4
  • TI-2026-10142 A vulnerability has been identified in centraldogma-server-mirror-git versions prior to… CVSS 4.0HIGH 8.8
  • TI-2026-10145 LDAP injection in LY Corporation Central Dogma CVSS 4.0MEDIUM 6.9
  • TI-2026-14054 A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. CVSS 4.0HIGH 8.7
  • TI-2026-10146 A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS… CVSS 4.0CRITICAL 9.1
  • TI-2026-85778 Excessive memory allocation in Armeria from malformed Thrift messages CVSS 4.0HIGH 8.7
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences