@omneedia/client-js (>=2.0.1, <=2.1.1), @omneedia/ssr (0.0.2) +9 more potentially affected by CVE-2026-47430 via cordova-plugin-inappbrowser (>=3.2.0, <=5.0.0)

cordova-plugin-inappbrowser NPM version =3.2.0, =2.0.1, =0.5.72, =1.0.0-rc.3, =2.1.2, =0.0.1, =0.2.5, =0.2.7 - poad 2.1.1 - things-factory-on-tv 2.0.0 Source cves: CVE-2026-47430 Source advisory: SNYK:JS-CORDOVAPLUGININAPPBROWSER-17337040...

vedichoroo (1.0.0) potentially affected by CVE-2019-0219 via cordova-plugin-inappbrowser (3.0.0)

cordova-plugin-inappbrowser NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cordova-plugin-inappbrowser and may be impacted: - vedichoroo 1.0.0 Source cves: CVE-2019-0219 Source advisory: OSV:GHSA-C6PW-Q7F2-97HV...

GHSA-C6PW-Q7F2-97HV Privilege Escalation in cordova-plugin-inappbrowser

Versions of cordova-plugin-inappbrowser prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI. This affects Cordova Android...