@omneedia/client-js (>=2.0.1 <=2.1.1), @omneedia/ssr (=0.0.2) +9 more potentially affected by CVE-2026-47430 via cordova-plugin-inappbrowser (>=3.2.0 <=5.0.0)

cordova-plugin-inappbrowser NPM version =3.2.0, =2.0.1, =0.5.72, =1.0.0-rc.3, =2.1.2, =0.0.1, =0.2.5, =0.2.7 - poad =2.1.1 - things-factory-on-tv =2.0.0 Source cves: CVE-2026-47430 Source advisory: SNYK:JS-CORDOVAPLUGININAPPBROWSER-17337040...

@brettparkhurst/kinetic (>=2.0.0 <=2.0.17), @omneedia/client-js (>=2.0.1 <=2.1.1) +19 more potentially affected by CVE-2026-47430 via cordova-plugin-inappbrowser (>=1.7.2 <=5.0.0)

cordova-plugin-inappbrowser NPM version =1.7.2, =2.0.0, =2.0.1, =0.5.72, =16.0.0, =1.2.0, =1.0.0-rc.3, =2.1.2, =0.0.1, =1.0.13, =0.0.1, =0.2.5, =0.2.7 and more Source cves: CVE-2026-47430 Source advisory: OSV:GHSA-Q42J-X8RQ-PJG6...

CVE-2026-47430

CVE-2026-47430 affects the iOS implementation of Cordova Plugin InAppBrowser. The issue arises when the WKScriptMessage id field is passed to commandDelegate sendPluginResult:callbackId: without format validation (CDVWKInAppBrowser.m:560–574), allowing a web content loaded in the InAppBrowser to ...

CVE-2026-47430

creationtimestamp| type| source ---|---|--- 2026-06-07 12:56:45+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnp7ql7avr2p 2026-06-08 13:40:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrsnt5lla2i 2026-06-09 00:51:01+00:00| seen|...