Leaking of user information on Cross-Domain communication in sysend

Description

Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted. This is not a big impact because it happens only on the same browser.

Recommendation

Update the sysend package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.10.0
• Patched version(s): 1.10.0

References

• GHSA-4vvg-x86p-mvqc
• CVE-2022-24762
• CWE-200
• CWE-346
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) - CVE-2025-4643
• Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565

Tags:

npm

sysend