@omneedia/client-js (>=2.0.1, <=2.1.1), @omneedia/ssr (0.0.2) +9 more potentially affected by CVE-2026-47430 via cordova-plugin-inappbrowser (>=3.2.0, <=5.0.0)

cordova-plugin-inappbrowser NPM version =3.2.0, =2.0.1, =0.5.72, =1.0.0-rc.3, =2.1.2, =0.0.1, =0.2.5, =0.2.7 - poad 2.1.1 - things-factory-on-tv 2.0.0 Source cves: CVE-2026-47430 Source advisory: SNYK:JS-CORDOVAPLUGININAPPBROWSER-17337040...

CVE-2026-47430

Summary The iOS implementation of "cordova-plugin-inappbrowser" passes the "id" field from a "WKScriptMessage" body to "commandDelegate sendPluginResult:callbackId:" with no format validation "CDVWKInAppBrowser.m:560–574". Any web content loaded inside the InAppBrowser can fire any pending Cordov...

@brettparkhurst/kinetic (>=2.0.0, <=2.0.17), @omneedia/client-js (>=2.0.1, <=2.1.1) +19 more potentially affected by CVE-2026-47430 via cordova-plugin-inappbrowser (>=1.7.2, <=5.0.0)

cordova-plugin-inappbrowser NPM version =1.7.2, =2.0.0, =2.0.1, =0.5.72, =16.0.0, =1.2.0, =1.0.0-rc.3, =2.1.2, =0.0.1, =1.0.13, =0.0.1, =0.2.5, =0.2.7 and more Source cves: CVE-2026-47430 Source advisory: MEND:CVE-2026-47430...

CVE-2026-47430: Improper Input Validation

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

vedichoroo (1.0.0) potentially affected by CVE-2019-0219 via cordova-plugin-inappbrowser (3.0.0)

cordova-plugin-inappbrowser NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cordova-plugin-inappbrowser and may be impacted: - vedichoroo 1.0.0 Source cves: CVE-2019-0219 Source advisory: OSV:GHSA-C6PW-Q7F2-97HV...

GHSA-C6PW-Q7F2-97HV Privilege Escalation in cordova-plugin-inappbrowser

Versions of cordova-plugin-inappbrowser prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI. This affects Cordova Android...

vedichoroo (1.0.0) potentially affected by CVE-2019-0219 via cordova-plugin-inappbrowser (3.0.0)

cordova-plugin-inappbrowser NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cordova-plugin-inappbrowser and may be impacted: - vedichoroo 1.0.0 Source cves: CVE-2019-0219 Source advisory: GHSA-C6PW-Q7F2-97HV...

@brettparkhurst/kinetic (>=2.0.0, <=2.0.17), appworks-js (>=16.0.0, <=16.0.1) +8 more potentially affected by CVE-2019-0219 via cordova-plugin-inappbrowser (>=1.7.2, <=3.0.0)

cordova-plugin-inappbrowser NPM version =1.7.2, =2.0.0, =16.0.0, =1.2.0, =0.0.1, =1.0.13, =0.3.2, =1.0.0, =1.2.4 Source cves: CVE-2019-0219 Source advisory: MEND:CVE-2019-0219...

PT-2019-5794

Name of the Vulnerable Software and Affected Versions cordova-plugin-inappbrowser versions prior to 3.1.0 Description The issue is related to the Cordova In-App-Browser extension for Android, where a lack of protection for the web page structure can be exploited. This allows a remote attacker to...