Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-112148 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.2 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/line/liff/security/advisories/GHSA-wppr-qmp4-w627	[email protected]	AdvisoryRemedyVendor
https://line.github.io/security-advisory-blog/CVE-2026-112148/	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	CISA-ADP

Affected Products

Product	Versions
LINE LIFF SDK	>= 2.20.0, <= 2.31.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 2.31.1moderate effort Workaround:moderate effort Switch to using the CDN edge URL: https://static.line-scdn.net/liff/edge/2/sdk.js, which automatically receives updated SDK releases. Workaround:moderate effort Update the SDK URL to a fixed version if using a fixed CDN version. Workaround:moderate effort Update the @line/liff dependency and lockfile if using npm, then rebuild the application and deploy the updated bundle. Workaround:moderate effort Replace any application-managed copies of the SDK with a fixed version. Workaround:moderate effort Update application-managed caches that retain an affected SDK or application bundle as part of deployment.

Product

Versions

LINE LIFF SDK

>= 2.20.0, <= 2.31.0 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 2.31.1moderate effort
Workaround:moderate effort
Switch to using the CDN edge URL: https://static.line-scdn.net/liff/edge/2/sdk.js, which automatically receives updated SDK releases.
Workaround:moderate effort
Update the SDK URL to a fixed version if using a fixed CDN version.
Workaround:moderate effort
Update the @line/liff dependency and lockfile if using npm, then rebuild the application and deploy the updated bundle.
Workaround:moderate effort
Replace any application-managed copies of the SDK with a fixed version.
Workaround:moderate effort
Update application-managed caches that retain an affected SDK or application bundle as part of deployment.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 20, 2026	CVE Modified	CISA-ADP
Oct 20, 2026	New CVE Received	[email protected]