CVE-2025-25300
smartbanner.js rel noopener XSS vulnerability
smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile third parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner. rel="noopener" is automatically populated to links as of v1.14.1 which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure View link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If View link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1, rel="noopener" is imposed on all target="_blank" links. Version 1.14.1 of smartbanner.js contains a fix for the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
smartbanner.js rel noopener XSS vulnerability
smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile third parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner. rel="noopener" is automatically populated to links as of v1.14.1 which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure View link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If View link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1, rel="noopener" is imposed on all target="_blank" links. Version 1.14.1 of smartbanner.js contains a fix for the issue.
- Record
CVE-2025-25300- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-601, CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2019-0661
smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile third parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner. rel="noopener" is automatically populated to links as of v1.14.1 which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure View link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If View link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1, rel="noopener" is imposed on all target="_blank" links. Version 1.14.1 of smartbanner.js contains a fix for the issue.
- Record
EUVD-2019-0661- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9mrq-cjgh-32g2
smartbanner.js rel noopener vulnerability
rel noopener vulnerability
Impact
Clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile 3rd parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner.
Patches
rel="noopener" is automatically populated to links as of v1.14.1 which is a recommended upgrade to resolve the vulnerability.
Workarounds
If you can not upgrade to v1.14.1:
-
Ensure View link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams
-
If View link is going to a 3rd party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,
rel="noopener"is imposed on alltarget="_blank"links.Following combination of smartbanner meta tags can be used to achieve the above:
<meta name="smartbanner:enabled-platforms" content="none"> <meta name="smartbanner:include-user-agent-regex" content="Mobile.*Safari">
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in smartbanner.js
- Record
GHSA-9mrq-cjgh-32g2- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-79, CWE-601
- Updated
- 2026-11-02
NVD
smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile third parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner. rel="noopener" is automatically populated to links as of v1.14.1 which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure View link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If View link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1, rel="noopener" is imposed on all target="_blank" links. Version 1.14.1 of smartbanner.js contains a fix for the issue.
- Record
CVE-2025-25300- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79, CWE-601
- Updated
- 2026-11-02
OSV
smartbanner.js rel noopener XSS vulnerability
smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile third parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner. rel="noopener" is automatically populated to links as of v1.14.1 which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure View link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If View link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1, rel="noopener" is imposed on all target="_blank" links. Version 1.14.1 of smartbanner.js contains a fix for the issue.
- Record
CVE-2025-25300- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-601, CWE-79
- Updated
- 2026-11-02
OSVGHSA-9mrq-cjgh-32g2
smartbanner.js rel noopener vulnerability
rel noopener vulnerability
Impact
Clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile 3rd parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner.
Patches
rel="noopener" is automatically populated to links as of v1.14.1 which is a recommended upgrade to resolve the vulnerability.
Workarounds
If you can not upgrade to v1.14.1:
-
Ensure View link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams
-
If View link is going to a 3rd party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,
rel="noopener"is imposed on alltarget="_blank"links.Following combination of smartbanner meta tags can be used to achieve the above:
<meta name="smartbanner:enabled-platforms" content="none"> <meta name="smartbanner:include-user-agent-regex" content="Mobile.*Safari">
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in smartbanner.js
- Record
GHSA-9mrq-cjgh-32g2- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-601, CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
smartbanner.jsnpm |
before 1.14.1 | 1.14.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-25300 is a low vulnerability (CVSS 1.3) in Ain Smartbanner.js, published September 13, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in smartbanner.js 1.14.1.
References
github.com/ain/smartbanner.js/security/advisories/GHSA-9mrq-cjgh-32g2
nvd.nist.gov/vuln/detail/CVE-2025-25300