CVE-2026-112148: CWE-79 in LY Corporation LIFF SDK

CVE-2026-112148 is a DOM-based XSS vulnerability in LY Corporation's LIFF SDK affecting versions from 2.20.0 up to but not including 2.31.1. The vulnerability enables an attacker to execute arbitrary JavaScript code within the origin of the LIFF application's endpoint when a user opens a maliciously crafted URL externally. This can result in exposure of sensitive data accessible via JavaScript, such as authentication tokens, or allow unauthorized actions leveraging the user's session. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and limited scope and impact.

Successful exploitation allows arbitrary JavaScript execution in the context of the affected LIFF application, potentially leading to disclosure of authentication tokens or application data accessible via JavaScript, and unauthorized actions performed with the user's session. This can compromise user data confidentiality and session integrity within the affected application.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening URLs from untrusted sources in external browsers when using affected LIFF SDK versions.