CVE-2022-24762

MEDIUM

sysend.js <1.10.0 - CSRF

Title source: llm

Description

sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.

References (4)

Scores

CVSS v3 6.5
EPSS 0.0020
EPSS Percentile 41.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Classification

CWE
CWE-346 CWE-200
Status published

Affected Products (2)

sysend.js_project/sysend.js < 1.10.0
npm/sysend < 1.10.0npm

Timeline

Published Mar 14, 2022
Tracked Since Feb 18, 2026