CVE-2022-24762

sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.

• CWE-200
• CWE-346

• https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431aPatch, Third Party Advisory
• https://github.com/jcubic/sysend.js/issues/33Exploit, Issue Tracking, Third Party Advisory
• https://github.com/jcubic/sysend.js/releases/tag/1.10.0Release Notes, Third Party Advisory
• https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqcThird Party Advisory
• https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431aPatch, Third Party Advisory
• https://github.com/jcubic/sysend.js/issues/33Exploit, Issue Tracking, Third Party Advisory
• https://github.com/jcubic/sysend.js/releases/tag/1.10.0Release Notes, Third Party Advisory
• https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqcThird Party Advisory

Published

Mar 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24757The Jupyter Server provides the backend (i.e. the core servi…7.5
• CVE-2022-24758The Jupyter notebook is a web-based notebook environment for…7.5
• CVE-2022-24759`@chainsafe/libp2p-noise` contains TypeScript implementation…7.4
• CVE-2022-2476A null pointer dereference bug was found in wavpack-5.4.0 Th…5.5
• CVE-2022-24760Parse Server is an open source http web server backend. In v…10
• CVE-2022-24761Waitress is a Web Server Gateway Interface server for Python…7.5
• CVE-2022-24763PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24764PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24765Git for Windows is a fork of Git containing Windows-specific…7.8
• CVE-2022-24766mitmproxy is an interactive, SSL/TLS-capable intercepting pr…9.8
• CVE-2022-24767GitHub: Git for Windows' uninstaller vulnerable to DLL hijac…7.8
• CVE-2022-24768Argo CD is a declarative, GitOps continuous delivery tool fo…8.8