DOM-based Cross-Site Scripting Vulnerability in LIFF SDK by LINE Corporation

CVE-2026-112148

What is CVE-2026-112148?

A vulnerability exists within certain versions of the LIFF SDK, where improper handling of user input can result in a DOM-based cross-site scripting (XSS) flaw. This vulnerability permits attackers to execute malicious JavaScript on the affected application's endpoint by crafting a specific URL that a user may open in an external browser. As a result, sensitive data, such as JavaScript-accessible authentication tokens, may be exposed, and unauthorized actions can be performed in the context of the user's session. Developers are urged to implement appropriate validation measures to mitigate this risk.

References