Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-59410 State: PUBLISHED Published: 2025-09-17T19:58:54.083Z Last Updated: 2025-09-18T15:47:03.096Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-311 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing the network request so that a different piece of data gets downloaded. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragon
fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-mcvp-rpgg-9273 - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59411 State: PUBLISHED Published: 2025-09-22T16:14:23.843Z Last Updated: 2025-09-22T17:26:43.827Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: cubecart Products: v6 Problem Types: CWE-79 Description: CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user input is not being escaped or sanitized before being output in email (and possibly when re-rendering the form), leading to Cross-Site Scripting / HTM
sanitized before being output in email (and possibly when re-rendering the form), leading to Cross-Site Scripting / HTML injection risk in email clients or admin UI. This issue has been patched in version 6.5.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cubecart/v6/security/advisories/GHSA-5hg3-m3q3-v2p4 - https://github.com/cubecart/v6/commit/299065bd4a8836782ce92f70988c730f130756db - https://github.com/cubecart/v6/commit/48336c54532705873a8c4106208c2d596f128047
CVE ID: CVE-2025-59412 State: PUBLISHED Published: 2025-09-22T16:14:44.152Z Last Updated: 2025-09-22T17:26:36.393Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: cubecart Products: v6 Problem Types: CWE-79 Description: CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the injected HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to
HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to display unwanted content. This issue has been patched in version 6.5.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cubecart/v6/security/advisories/GHSA-qfrx-vvvp-h5m2 - https://github.com/cubecart/v6/commit/1a0c0d8f6c9c141575eb5be07d04e7d49820005b - https://github.com/cubecart/v6/commit/7d4bf593304332fa1258d4f0b10dd7c9f6283a86
CVE ID: CVE-2025-59413 State: PUBLISHED Published: 2025-09-22T16:15:00.351Z Last Updated: 2025-09-22T17:26:29.173Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: cubecart Products: v6 Problem Types: CWE-862 Description: CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11. Additional Analyst Notes: - CISA ADP Vul
alid subscriber’s email address. This issue has been patched in version 6.5.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f - https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79 - https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271 - https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128
CVE ID: CVE-2025-59414 State: PUBLISHED Published: 2025-09-17T18:39:38.193Z Last Updated: 2025-09-17T19:42:44.734Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: nuxt Products: nuxt Problem Types: CWE-22 Description: Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are a
The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gi
sequences. Update to Nuxt 3.19.0+ or 4.1.0+. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6 - https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595
CVE ID: CVE-2025-59415 State: PUBLISHED Published: 2025-09-17T21:07:58.471Z Last Updated: 2025-09-18T13:58:43.346Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: frappe Products: lms Problem Types: CWE-79 Description: Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learning where the system did not adequately sanitize the content uploaded in the profile bio. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/lms/security/a
f other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/lms/security/advisories/GHSA-h7gh-3vq5-96jx - https://github.com/frappe/lms/commit/ed162e254690772365d4d1365f176b59bc4db72d
CVE ID: CVE-2025-59416 State: PUBLISHED Published: 2025-09-17T18:52:51.029Z Last Updated: 2025-09-17T19:03:15.936Z Vendors: The-Scratch-Channel Products: tsc-web-client Problem Types: CWE-862 Description: The Scratch Channel is a news website. If the user makes a fork, they can change the admins and make an article. Since the API uses a POST request, it will make an article. This issue is fixed in v1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/The-Scratch-Channel/tsc-web-client/security/advisories/GHSA-775w-g375-pjff
CVE ID: CVE-2025-59417 State: PUBLISHED Published: 2025-09-18T14:38:55.012Z Last Updated: 2025-09-19T17:09:51.521Z Vendors: lobehub Products: lobe-chat Problem Types: CWE-79 Description: Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting (XSS) vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine. In lobe-chat, when the response from the server is like <lobeArtifact identifier="ai-new-interpretation" ...> , it will be rendered with the lobeArtifact node, instead of the plain text. However, when the type of the lobeArtifact is image/svg+xml , it wil
h the lobeArtifact node, instead of the plain text. However, when the type of the lobeArtifact is image/svg+xml , it will be rendered as the SVGRender component, which internally uses dangerouslySetInnerHTML to set the content of the svg, resulting in XSS attack. Any party capable of injecting content into chat messages, such as hosting a malicious page for prompt injection, operating a compromised MCP server, or leveraging tool integrations, can exploit this vulnerability. This vulnerability is fixed in 1.129.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lobehub/lobe-chat/security/advisories/GHSA-m79r-r765-5f9j - https://github.com/lobehub/lobe-chat/
: - https://github.com/lobehub/lobe-chat/security/advisories/GHSA-m79r-r765-5f9j - https://github.com/lobehub/lobe-chat/commit/9f044edd07ce102fe9f4b2fb47c62191c36da05c
CVE ID: CVE-2025-59418 State: PUBLISHED Published: 2025-09-22T18:02:45.984Z Last Updated: 2025-09-22T18:21:35.922Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: GSYT-Productions Products: BunnyPad-SRC Problem Types: CWE-770 Description: BunnyPad is a note taking software. Prior to version 11.0.27000.0915, opening files greater than or equal to 20MB causes buffer overflow to occur. This issue has been patched in version 11.0.27000.0915. Users who wish not to upgrade should refrain from opening files larger than 10MB. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GSYT-Productions/BunnyPad-SRC/security/advisories/GHSA-qhw
es: - CISA ADP Vulnrichment: References: - https://github.com/GSYT-Productions/BunnyPad-SRC/security/advisories/GHSA-qhw4-c7x5-vxmj - https://github.com/GSYT-Productions/BunnyPad-SRC/commit/d9224eb5e13c24ac148a77dff93e53c21f066533
CVE ID: CVE-2025-59419 State: PUBLISHED Published: 2025-10-15T15:42:30.922Z Last Updated: 2025-10-17T19:44:00.417Z Vendors: netty Products: netty Problem Types: CWE-93 Description: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerability exists in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string without sanitization. When methods such as SmtpRequests
arameters are directly concatenated into the SMTP command string without sanitization. When methods such as SmtpRequests.rcpt(recipient) are called with a malicious string containing CRLF sequences, attackers can inject arbitrary SMTP commands. Because the injected commands are sent from the server's trusted IP address, resulting emails will likely pass SPF and DKIM authentication checks, making them appear legitimate. This allows remote attackers who can control SMTP command parameters (such as email recipients) to forge arbitrary emails from the trusted server, potentially impersonating executives and forging high-stakes corporate communications. This issue has been patched in versions 4.1
y impersonating executives and forging high-stakes corporate communications. This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86 - https://github.com/netty/netty/commit/1782e8c2060a244c4d4e6f9d9112d5517ca05120
CVE ID: CVE-2025-59420 State: PUBLISHED Published: 2025-09-22T17:28:53.869Z Last Updated: 2025-11-03T17:45:19.901Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: authlib Products: authlib Problem Types: CWE-345, CWE-863 Description: Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain v
ple, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32 - https://github.com/authlib/authlib/commit/6b1813e4392eb7c168c276099ff7783b176479df
CVE ID: CVE-2025-59421 State: PUBLISHED Published: 2025-09-18T14:42:40.662Z Last Updated: 2025-09-19T17:09:44.449Z Vendors: frappe Products: press Problem Types: CWE-770 Description: Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood the inbox of a user by repeatedly sending invites (duplicate). The issue is fixed in commit 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/press/security/advisories/GHSA-68qm-vp8f-rpr3 - https://github.com/frappe/press/commit/83c3fc7676c5dbbe1fd5092d21d95a10c7b48615
CVE ID: CVE-2025-59422 State: PUBLISHED Published: 2025-09-25T13:19:11.385Z Last Updated: 2025-09-25T15:14:52.506Z Vendors: langgenius Products: dify Problem Types: CWE-284 Description: Dify is an open-source LLM app development platform. In version 1.8.1, a broken access control vulnerability on the /console/api/apps/<APP_ID>chat-messages?conversation_id=<CONVERSATION_ID>&limit=10 endpoint allows users in the same workspace to read chat messages of other users. A regular user is able to read the query data and the filename of the admins and probably other users chats, if they know the conversation_id. This impacts the confidentiality of chats. This issue has been patched in version 1.9.0. A
hey know the conversation_id. This impacts the confidentiality of chats. This issue has been patched in version 1.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langgenius/dify/security/advisories/GHSA-jg5j-c9pq-w894 - https://github.com/langgenius/dify/commit/b2d8a7eaf1693841411934e2056042845ab4f354
CVE ID: CVE-2025-59424 State: PUBLISHED Published: 2025-09-18T19:53:38.718Z Last Updated: 2025-09-18T20:05:47.823Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Kovah Products: LinkAce Problem Types: CWE-79 Description: LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker can set a malicious JavaScript payload as their username. When an action performed by this user is recorded (e.g., generate or revoke an API token
ript payload as their username. When an action performed by this user is recorded (e.g., generate or revoke an API token), the payload is stored in the database. The script is then executed in the browser of any user, particularly administrators, who views the /system/audit page. This vulnerability is fixed in 2.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Kovah/LinkAce/security/advisories/GHSA-289g-9gff-p4wh - https://github.com/Kovah/LinkAce/commit/c0d21b974b32f1ca2fab550fb476c573a068e196
CVE ID: CVE-2025-59425 State: PUBLISHED Published: 2025-10-07T14:06:49.042Z Last Updated: 2025-10-07T15:28:10.303Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: vllm-project Products: vllm Problem Types: CWE-385 Description: vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more characters the provided API key gets correct. Data analysis across many attempts could allow an attacker to determine when it finds the next correct character in the k
ata analysis across many attempts could allow an attacker to determine when it finds the next correct character in the key sequence. Deployments relying on vLLM's built-in API key validation are vulnerable to authentication bypass using this technique. Version 0.11.0rc2 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-wr9h-g72x-mwhm - https://github.com/vllm-project/vllm/commit/ee10d7e6ff5875386c7f136ce8b5f525c8fcef48 - https://github.com/vllm-project/vllm/blob/4b946d693e0af15740e9ca9c0e059d5f333b1083/vllm/entrypoints/openai/api_server.py#L1270-L1274 - https://github.com/vllm-project/vllm/releases/
9ca9c0e059d5f333b1083/vllm/entrypoints/openai/api_server.py#L1270-L1274 - https://github.com/vllm-project/vllm/releases/tag/v0.11.0
CVE ID: CVE-2025-59426 State: PUBLISHED Published: 2025-09-25T14:00:09.629Z Last Updated: 2025-09-25T14:18:27.175Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: lobehub Products: lobe-chat Problem Types: CWE-601 Description: Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project's OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value. In deployments where a reverse proxy forwards client-supplied X-Forwarded-* headers to the origin as-is, or where the origin trusts them without validation, an atta
s client-supplied X-Forwarded-* headers to the origin as-is, or where the origin trusts them without validation, an attacker can inject an arbitrary host and trigger an open redirect that sends users to a malicious domain. This issue has been patched in version 1.130.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lobehub/lobe-chat/security/advisories/GHSA-xph5-278p-26qx - https://github.com/lobehub/lobe-chat/commit/70f52a3c1fadbd41a9db0e699d1e44d9965de445 - https://github.com/lobehub/lobe-chat/blob/aa841a3879c30142720485182ad62aa0dbd74edc/src/app/(backend)/oidc/consent/route.ts#L113-L127
CVE ID: CVE-2025-59427 State: PUBLISHED Published: 2025-09-19T15:30:10.139Z Last Updated: 2025-09-19T16:05:12.864Z Vendors: cloudflare Products: workers-sdk Problem Types: CWE-200 Description: The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-4pfg-2mw5-f8jx - ht
A ADP Vulnrichment: References: - https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-4pfg-2mw5-f8jx - https://github.com/cloudflare/workers-sdk/commit/0e500720bf70016fa4ea21fc8959c4bd764ebc38 - https://hackerone.com/reports/3117837 - https://github.com/cloudflare/workers-sdk/discussions/3455#discussioncomment-6165773
CVE ID: CVE-2025-59428 State: PUBLISHED Published: 2025-10-14T14:38:20.090Z Last Updated: 2025-10-14T16:03:42.715Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: espocrm Products: espocrm Problem Types: CWE-352 Description: EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit permissions can embed a malicious SVG element containing a link in the body field of an article. When an authenticated user clicks the malicious lin
cious SVG element containing a link in the body field of an article. When an authenticated user clicks the malicious link, they are redirected to an attacker-controlled HTML page that executes a CSRF request against the api/v1/User endpoint. If the victim is prompted for and enters their credentials, an attacker-controlled account is created with privileges determined by the CSRF payload. This issue has been patched in version 9.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espocrm/espocrm/security/advisories/GHSA-c26c-wvhr-fr6r
CVE ID: CVE-2025-59429 State: PUBLISHED Published: 2025-10-14T19:26:02.072Z Last Updated: 2025-10-14T19:43:16.225Z Vendors: FreePBX Products: security-reporting Problem Types: CWE-79 Description: FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and is available by default on version 16 via any bound IP address at port 8088. By default on version 17, the binding is only to localhost IP, making it significantly less vulnerable. The vulnerability can be e
on version 17, the binding is only to localhost IP, making it significantly less vulnerable. The vulnerability can be exploited by unauthenticated attackers to obtain cookies from logged-in users, allowing them to hijack a session of an administrative user. The theft of admin session cookies allows attackers to gain control over the FreePBX admin interface, enabling them to access sensitive data, modify system configurations, create backdoor accounts, and cause service disruption. This issue has been patched in version 16.0.68.39 for FreePBX 16 and version 17.0.18.38 for FreePBX 17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reportin
reePBX 17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-c8g7-475j-fwcc
CVE ID: CVE-2025-59430 State: PUBLISHED Published: 2025-09-22T18:47:04.643Z Last Updated: 2025-09-22T19:43:47.837Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: FrontFin Products: mesh-web-sdk Problem Types: CWE-79 Description: Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker c
l page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f - https://github.com/FrontFin/mesh-web-sdk/pull/124 - https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2 - https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441