High severity8.2OSV Advisory· Published Sep 22, 2025· Updated Apr 15, 2026
CVE-2025-59430
CVE-2025-59430
Description
Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@meshconnect/web-link-sdknpm | < 3.3.2 | 3.3.2 |
Affected products
2- Range: 2.0.0, 2.0.3, 2.0.4, …
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-vh3f-qppr-j97fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-59430ghsaADVISORY
- github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.tsnvdWEB
- github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2nvdWEB
- github.com/FrontFin/mesh-web-sdk/pull/124nvdWEB
- github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97fnvdWEB
News mentions
0No linked articles in our index yet.