GHSA-4vvg-x86p-mvqc

Leaking of user information on Cross-Domain communication in sysend

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-24762

Packages

Ecosystem	Package	Affected	Fixed in
npm	sysend	< 1.10.0	1.10.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted. This is not a big impact because it happens only on the same browser. ### Patches It has been patched in version 1.10.0 ### Workarounds The only workaround is to not send sensitive information with sysend messages.

References

External links from the advisory. They lead to third-party sites.

https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqc web
https://nvd.nist.gov/vuln/detail/CVE-2022-24762 advisory
https://github.com/jcubic/sysend.js/issues/33 web
https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431a web
https://github.com/jcubic/sysend.js web
https://github.com/jcubic/sysend.js/releases/tag/1.10.0 web