Unintended Proxy or Intermediary ('Confused Deputy')

Overview storybook is a frontend workshop for building UI components and pages in isolation. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/experimental-addon-test is an Integrate Vitest with Storybook Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not validate the...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/addon-mcp is a Help agents automatically write and test stories for your UI components Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, whi...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/core-server is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not validate the origin of...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/core is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not validate the origin of incoming...

CLSA-2026-1792471629 TuxCare security update for @storybook/channel-postmessage (1 CVE)

TuxCare rebuilt @storybook/channel-postmessage to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

PT-2026-133336

TuxCare rebuilt @storybook/channel-postmessage to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

GHSA-VQFF-R82H-9CRC ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

Summary The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to...

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

Summary The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to...

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to reach th...

PT-2026-116191

Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.112 Description The DataStore table UI in src/resources/datastore-table-ui.ts fails to validate the event.origin of inbound window message events and sends outbound JSON-RPC messages using a wildcard targe...

posta

Posta Posta es una herramienta para investigar la comunicación de Mensajería entre Documentos Cross-document Messaging. Permite rastrear, explorar y explotar vulnerabilidades de postMessage, e incluye funciones como la reproducción de mensajes enviados entre ventanas dentro de cualquier navegador...

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...

advisories

Sobre mí Twitter: @justinsteven Blog: https://www.justinsteven.com/ Avisos de seguridad Listados en orden cronológico inverso. Haz clic en cualquier título para leer el aviso completo. Gartner Peer Insights Widget postMessage DOM XSS Fecha de divulgación: 2023-02-03 El Gartner Peer Insights Widge...

CVE-2026-100182

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-91245

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100182 Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100182

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.2.10 . The root cause is insufficient input sanitization and output escaping involving Cross-Origin postMessage to the Admin Editor. An unauthenticated attacker can t...

CVE-2026-100182 Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

PT-2026-104117

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...