A high-severity cross-site scripting vulnerability in the FrontFin mesh-web-sdk allows unauthenticated attackers to execute arbitrary code within the context of the parent application.

This vulnerability involves an improper neutralization of input, specifically the lack of sanitization for URL protocols within the createLink.openLink function. An unauthenticated attacker can leverage this flaw to execute arbitrary JavaScript in the context of the parent page, potentially gaining access to DOM elements, session data, and cookies.

The ability for an attacker to execute arbitrary code in the user's browser poses a significant risk to sensitive user data and application integrity. Given the CVSS score of 8.2, this vulnerability is classified as High, reflecting the potential for session hijacking and the compromise of confidential information stored within the web session. Organizations relying on this SDK for financial or sensitive integrations face a high risk of unauthorized account access and data exfiltration.

Immediate Action: Update the @meshconnect/web-link-sdk package to version 3.3.2 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review web application logs for suspicious URL parameters or unexpected script execution patterns within the browser console.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be loaded and executed, effectively mitigating the impact of cross-site scripting attacks.

Public Exploit Available: Unknown

The presence of a proof-of-concept and the high CVSS score necessitate an immediate update to version 3.3.2. Security teams should prioritize patching this SDK to prevent potential session theft and unauthorized access to user data. Failure to address this vulnerability exposes the parent application to severe client-side attacks.