Published:2026/10/22  Last Updated:2026/10/22

JVNVU#91023667
LIFF SDK vulnerable to cross-site scripting

Overview

LIFF SDK provided by LY Corporation contains a cross-site scripting vulnerability.

Products Affected

  • LIFF SDK versions 2.20.0 through 2.31.0

Description

LIFF SDK provided by LY Corporation contains the following vulnerability.

  • DOM based Cross-site Scripting (CWE-79)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Base Score 5.1
    • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score 6.1
    • CVE-2026-112148

Impact

An arbitrary script may be executed on the web browser of the user who accessed the website using the product.

Solution

Update the Software
Update the affected product to the latest version according to the information provided by the developer.
The following version has been released to address this vulnerability:

  • LIFF SDK 2.31.1
For details, refer to the information provided by the developer.

Vendor Status

Vendor Link
LY Corporation CVE-2026-112148
DOM-based cross-site scripting in LIFF SDK

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

LY Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LY Corporation coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE
JVN iPedia