CVE-2026-103922
2 advisories.
npm/@capacitor/android CVE-2026-103922: critical 9.3
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Action: Upgrade @capacitor/android to 6.2.2 or later.
npm i @capacitor/android@6.2.2npm i @capacitor/android@7.6.9npm i @capacitor/android@8.5.1npm i @capacitor/android@8.4.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.2.2 | - |
| 7.0.0 | 7.6.9 | - |
| 8.5.0 | 8.5.1 | - |
| 8.3.5 | 8.4.3 | - |
| 8.0.0 | - | 8.3.4 |
Fixed versions
| 6.2.2 | 7.6.9 | 8.5.1 | 8.4.3 |
Sources
- osv: GHSA-rvm3-566m-v7fv
- https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv
- https://nvd.nist.gov/vuln/detail/CVE-2026-103922
- https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e
- https://github.com/ionic-team/capacitor/commit/745b5f805bf77bc6463977cc7d718cd9de44ccbc
- https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb
- https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d
- https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4
- https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540
- https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922
- https://github.com/ionic-team/capacitor
- https://github.com/ionic-team/capacitor/releases/tag/8.5.1
CVE-2026-103922 · published · modified · JSON
npm/@capacitor/ios CVE-2026-103922: critical 9.3
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Action: Upgrade @capacitor/ios to 6.2.2 or later.
npm i @capacitor/ios@6.2.2npm i @capacitor/ios@7.6.9npm i @capacitor/ios@8.5.1npm i @capacitor/ios@8.4.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.2.2 | - |
| 7.0.0 | 7.6.9 | - |
| 8.5.0 | 8.5.1 | - |
| 8.3.5 | 8.4.3 | - |
| 8.0.0 | - | 8.3.4 |
Fixed versions
| 6.2.2 | 7.6.9 | 8.5.1 | 8.4.3 |
Sources
- osv: GHSA-rvm3-566m-v7fv#npm/@capacitor/ios
- https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv
- https://nvd.nist.gov/vuln/detail/CVE-2026-103922
- https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e
- https://github.com/ionic-team/capacitor/commit/745b5f805bf77bc6463977cc7d718cd9de44ccbc
- https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb
- https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d
- https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4
- https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540
- https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922
- https://github.com/ionic-team/capacitor
- https://github.com/ionic-team/capacitor/releases/tag/8.5.1
CVE-2026-103922 · published · modified · JSON