Maven/com.capacitorjs:core CVE-2026-103922: critical 9.3, EPSS 0.34%
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Action: Upgrade com.capacitorjs:core to 6.2.2 (6.2.x), 7.6.9 (7.6.x), 8.4.3 (8.4.x) or 8.5.1 (8.5.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.2.2 | - |
| 7.0.0 | 7.6.9 | - |
| 8.5.0 | 8.5.1 | - |
| 8.3.5 | 8.4.3 | - |
| 8.0.0 | - | 8.3.4 |
Fixed versions
| 6.2.2 | 7.6.9 | 8.5.1 | 8.4.3 |
Sources
- osv: GHSA-rvm3-566m-v7fv#Maven/com.capacitorjs:core
- https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv
- https://nvd.nist.gov/vuln/detail/CVE-2026-103922
- https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e
- https://github.com/ionic-team/capacitor/commit/745b5f805bf77bc6463977cc7d718cd9de44ccbc
- https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb
- https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d
- https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4
- https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540
- https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922
- https://github.com/ionic-team/capacitor
- https://github.com/ionic-team/capacitor/releases/tag/8.5.1
CVE-2026-103922 · published · modified · JSON