CVE-2015-9544 json
Improper Input Validation in xdLocalStorage
published 2020-04-07 6 y ago modified 2026-06-17 4 mo ago also GHSA-vrc7-6g8w-jh56 , EUVD-2021-2595
- cvss
- 7.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
Patch / fix
Exploit prediction
1.33% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- grimhacker.com https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-Origin-Magic-iframe referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | xdlocalstorage | <=2.0.5 |
no fix listed |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/ofirdagan/cross-domain-local-storage/pull/19
web, patch, third-party-advisory
-
github.com
/ofirdagan/cross-domain-local-storage/issues/17
web, patch, third-party-advisory
-
grimhacker.com
/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-Origin-Magic-iframe
web, exploit, third-party-advisory
-
github.com
/ofirdagan/cross-domain-local-storage
web, product, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2015-9544
advisory
Sources
- CVE List CVE-2015-9544
- GitHub Advisory GHSA-vrc7-6g8w-jh56
- NVD CVE-2015-9544
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.