@omneedia/client-js (>=2.0.1, <=2.1.1), @omneedia/ssr (0.0.2) +9 more potentially affected by CVE-2026-47430 via cordova-plugin-inappbrowser (>=3.2.0, <=5.0.0)

cordova-plugin-inappbrowser NPM version =3.2.0, =2.0.1, =0.5.72, =1.0.0-rc.3, =2.1.2, =0.0.1, =0.2.5, =0.2.7 - poad 2.1.1 - things-factory-on-tv 2.0.0 Source cves: CVE-2026-47430 Source advisory: SNYK:JS-CORDOVAPLUGININAPPBROWSER-17337040...

CVE-2026-47430

CVE-2026-47430 affects the iOS implementation of Cordova Plugin InAppBrowser. The issue arises when the WKScriptMessage id field is passed to commandDelegate sendPluginResult:callbackId: without format validation (CDVWKInAppBrowser.m:560–574), allowing a web content loaded in the InAppBrowser to ...

CVE-2026-47430

creationtimestamp| type| source ---|---|--- 2026-06-07 12:56:45+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnp7ql7avr2p 2026-06-08 13:40:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrsnt5lla2i 2026-06-09 00:51:01+00:00| seen|...