A DOM-based cross-site scripting flaw in the LIFF SDK allows an attacker to inject and execute arbitrary JavaScript code within the originating web page when a user opens a specially crafted URL in an external browser. This can lead to exposure of JavaScript-accessible authentication tokens or application data, and enable the attacker to perform unauthorized actions using the victim’s session. The weakness aligns with the cross‑site scripting category, CWE‑79, and carries a CVSS score of 5.1.

The vulnerability affects LY Corporation’s LIFF SDK, specifically versions 2.20.0 through 2.31.0 inclusive. All applications built with these SDK releases are subject to the issue.

The EPSS score indicates a less than 1% chance of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a user accessing a malicious URL from an external browser, which triggers the XSS payload in the of the LIFF application. The moderate CVSS score reflects that execution is limited to code running in the browser and does not provide full system compromise, but the potential for credential theft or session hijacking makes the risk non‑negligible.