CVE-2025-59430

Vulnerability

Overview

The Mesh Connect JS SDK prior to version 3.3.2 contains a cross-site scripting vulnerability in the createLink.openLink function. The function decodes base64-encoded link tokens and sets the resulting string as the src attribute of an iframe without validating the URL protocol [1][2][4]. This allows an attacker to supply a malicious payload such as javascript:alert(document.domain)// encoded as base64, which, when decoded and assigned to the iframe's src, executes arbitrary JavaScript in the context of the parent page [4].

Attack

Vector and Exploitation

To exploit this vulnerability, an attacker must be able to provide a crafted link token to the createLink.openLink function. No authentication is required; the attack can be launched remotely over a network. The attack requires user interaction, as the victim must trigger the openLink call (e.g., by clicking a link or visiting a page that uses the vulnerable SDK) [1][4]. The exploit is indistinguishable from a legitimate page at the rendering level, making it difficult for users or automated scanners to detect [4]. If the attacker can also control the customIframeId parameter, they can hijack the source of existing iframes on the page [4].

Impact

Successful exploitation allows the attacker to access the parent page's DOM, storage, session, and cookies. This can lead to data theft, session hijacking, or further cross-origin attacks. In the context of wallet integrations, the impact may be critical, potentially enabling unauthorized transactions or loss of funds [4]. The CVSS v3.1 score is 8.2 (High) with a scope of changed, reflecting the ability to access and modify resources beyond the vulnerable component [1][4].

Mitigation

The issue has been patched in Mesh Connect JS SDK version 3.3.2. Users are strongly recommended to update to this version or later [1][4]. There are no known workarounds for this vulnerability, as it stems from a lack of input validation in a core function. The advisory is published on GitHub Security Advisories under GHSA-vh3f-qppr-j97f [4].