CVE-2026-112148
Deferred Deferred - Pending Action

DOM-based XSS in LINE Front-end Framework SDK

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: LINE Corporation

Description
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-112148
EUVD
EUVD-2026-104810

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LY Corporation LIFF SDK 2.20.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a DOM-based cross-site scripting (XSS) vulnerability in LIFF SDK versions 2.20.0 through 2.31.0. It allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser.

Detection Guidance

Detecting this DOM-based XSS vulnerability requires checking LIFF SDK versions in use. Inspect your application's dependencies or SDK URLs to confirm if versions 2.20.0 through 2.31.0 are present. For npm-based projects, run commands like 'npm list @line/liff' or check package.json. For CDN-based setups, verify the SDK URL points to version 2.31.1 or later.

Impact Analysis

The vulnerability could lead to disclosure of authentication tokens, application data, or enable unauthorized actions using the user's session. Attackers may read localStorage data, cookies (except HttpOnly), modify content, or redirect users to phishing pages.

Compliance Impact

This DOM-based XSS vulnerability could lead to unauthorized access to authentication tokens, localStorage data, or cookies, which may include sensitive user data. This could violate GDPR's requirements for protecting personal data and HIPAA's safeguards for protected health information if such data is exposed or modified.

Mitigation Strategies

Immediately upgrade LIFF SDK to version 2.31.1 or later. For CDN users, no action is needed as updates are automatic. For npm or self-hosted apps, update dependencies, rebuild, and redeploy. Remove cached versions if they exist. Monitor for unusual activity post-update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...