CVE-2022-24762

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-346

Affected software

Vendor	Product	Versions
jcubic	sysend.js	< 1.10.0
jcubic	sysend	>= pkg:npm/sysend@0, < pkg:npm/sysend@1.10.0

References

https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431aPatch, Third Party Advisory
https://github.com/jcubic/sysend.js/issues/33Exploit, Issue Tracking, Third Party Advisory
https://github.com/jcubic/sysend.js/releases/tag/1.10.0Release Notes, Third Party Advisory
https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqcThird Party Advisory
https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431aPatch, Third Party Advisory
https://github.com/jcubic/sysend.js/issues/33Exploit, Issue Tracking, Third Party Advisory
https://github.com/jcubic/sysend.js/releases/tag/1.10.0Release Notes, Third Party Advisory
https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqcThird Party Advisory

Timeline

Published: Mar 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247637.5PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-serv CVE-2022-247647.5PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulne CVE-2022-247657.8Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where CVE-2022-247669.8mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perfo CVE-2022-247677.8GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.CVE-2022-247688.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerab CVE-2022-247695.9Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine)CVE-2022-24778.8Use after free in Guest View in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extens CVE-2022-247708.8`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers f CVE-2022-247717.5Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1 CVE-2022-247727.5Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1 CVE-2022-247735.3Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1