---
id: CVE-2026-112148
title: >-
  A vulnerability has been identified in LIFF SDK versions 2.20.0 through
  2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker
  to execute arbitrary JavaScript in the origin of an affected LIFF
  application's endpoint…
summary: >-
  A vulnerability has been identified in LIFF SDK versions 2.20.0 through
  2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker
  to execute arbitrary JavaScript in the origin of an affected LIFF
  application's endpoint…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: LY Corporation
product: LIFF SDK
affected:
  - liff_sdk >= 2.20.0 < 2.31.1
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T06:31:15.606Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112148'
references:
  - url: 'https://line.github.io/security-advisory-blog/CVE-2026-112148/'
  - url: 'https://github.com/line/liff/security/advisories/GHSA-wppr-qmp4-w627'
tags:
  - cve.org
ingestedAt: '2026-10-20T06:54:24.002Z'
---

## Overview

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

## Affected

- `liff_sdk >= 2.20.0 < 2.31.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.