{"action":"Upgrade @meshconnect/web-link-sdk to 3.3.2 or later.","affected":[{"fixed":"3.3.2","introduced":"0"}],"component":"@meshconnect/web-link-sdk","cve_ids":["CVE-2025-59430"],"ecosystem":"npm","epss":0.0043,"exploited":false,"fixed_versions":["3.3.2"],"ghsa_id":"GHSA-vh3f-qppr-j97f","id":"tcs_01M5KGBXF4514QT5JCGW3NJ83K","modified_at":"2025-09-22T21:58:19Z","published_at":"2025-09-22T21:09:27Z","references":["https://osv.dev/vulnerability/GHSA-vh3f-qppr-j97f","https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f","https://nvd.nist.gov/vuln/detail/CVE-2025-59430","https://github.com/FrontFin/mesh-web-sdk/pull/124","https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2","https://github.com/FrontFin/mesh-web-sdk","https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-vh3f-qppr-j97f","url":"https://osv.dev/vulnerability/GHSA-vh3f-qppr-j97f"}],"summary":"Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink"}