CVE-2026-112148

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

Vendor	ly corporation
Product	liff sdk
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for ly corporation liff sdk

Be the first to know when new unknown vulnerabilities affecting ly corporation liff sdk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

LY Corporation / LIFF SDK

2.20.0 < 2.31.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

line.github.io: https://line.github.io/security-advisory-blog/CVE-2026-112148/ github.com: https://github.com/line/liff/security/advisories/GHSA-wppr-qmp4-w627