Descriptions

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application’s endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user’s session.

Severity

  • CVSSv4.0 Score: 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N)

Affected Versions

  • LIFF SDK from 2.20.0 before 2.31.1

Fix

The vulnerability is fixed in LIFF SDK version 2.31.1. Upgrade affected applications to version 2.31.1 or later.

  • Applications using the CDN edge URL, https://static.line-scdn.net/liff/edge/2/sdk.js, receive updated SDK releases automatically. Verify that the deployed application loads a fixed version.
  • Applications using a fixed CDN version must update the SDK URL to a fixed version.
  • Applications using @line/liff from npm must update their dependency and lockfile as applicable, rebuild the application, and deploy the updated bundle.
  • Applications serving a copy of the SDK must replace that copy with a fixed version.

If application-managed caches retain an affected SDK or application bundle, update those caches as part of deployment.

Reference

  • https://www.cve.org/CVERecord?id=CVE-2026-112148
  • https://github.com/line/liff/security/advisories/GHSA-wppr-qmp4-w627

Updated: