{"id":"CVE-2025-25300","aliases":["EUVD-2019-0661","GHSA-9mrq-cjgh-32g2"],"status":"published","title":"smartbanner.js rel noopener XSS vulnerability","description":"smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile third parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner. `rel=\"noopener\"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure `View` link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If `View` link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel=\"noopener\"` is imposed on all `target=\"_blank\"` links. Version 1.14.1 of smartbanner.js contains a fix for the issue.","severity":{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00419,"percentile":0.36549,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601","CWE-79"],"published":"2019-09-13T13:22:33Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"npm","package":"smartbanner.js","fixed_in":["1.14.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"smartbanner.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1"}]}]},{"source":"osv","ecosystem":"npm","package":"smartbanner.js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.14.1"}]}]}],"products":[{"vendor":"ain","product":"smartbanner.js"}],"references":[{"url":"https://github.com/ain/smartbanner.js/security/advisories/GHSA-9mrq-cjgh-32g2","tags":["x_refsource_CONFIRM","x_refsource_MISC","advisory","web"]},{"url":"https://github.com/ain/smartbanner.js/commit/fce8c31dfe04033d9d005a89694d3e7a60784f89","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/advisories/GHSA-9mrq-cjgh-32g2","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25300.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25300","tags":["advisory"]},{"url":"https://github.com/ain/smartbanner.js","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-25300","title":"smartbanner.js rel noopener XSS vulnerability","description":"smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile third parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner. `rel=\"noopener\"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure `View` link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If `View` link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel=\"noopener\"` is imposed on all `target=\"_blank\"` links. Version 1.14.1 of smartbanner.js contains a fix for the issue.","status":"published","published":"2025-02-18T17:38:52.088Z","modified":"2025-02-18T18:53:49.77Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T14:32:31.971896Z"}],"euvd":[{"id":"EUVD-2019-0661","description":"smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile third parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner. `rel=\"noopener\"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure `View` link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If `View` link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel=\"noopener\"` is imposed on all `target=\"_blank\"` links. Version 1.14.1 of smartbanner.js contains a fix for the issue.","status":"published","published":"2025-02-18T17:38:52Z","modified":"2025-02-18T18:53:49Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T20:53:28.952595Z"}],"ghsa":[{"id":"GHSA-9mrq-cjgh-32g2","title":"smartbanner.js rel noopener vulnerability","description":"## rel noopener vulnerability\n\n### Impact\nClicking on smartbanner _View_ link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile 3rd parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner.\n\n### Patches\n`rel=\"noopener\"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability.\n\n### Workarounds\nIf you can not upgrade to `v1.14.1`:\n1. Ensure _View_ link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams\n2. If _View_ link is going to a 3rd party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel=\"noopener\"` is imposed on all `target=\"_blank\"` links.\n\n    Following combination of smartbanner meta tags can be used to achieve the above:\n\n    ```html\n    \u003cmeta name=\"smartbanner:enabled-platforms\" content=\"none\"\u003e\n    \u003cmeta name=\"smartbanner:include-user-agent-regex\" content=\"Mobile.*Safari\"\u003e\n    ```\n\n### References\n* [About rel=noopener](https://mathiasbynens.github.io/rel-noopener/)\n* [Safari 12.1 Release Notes](https://developer.apple.com/documentation/safari_release_notes/safari_12_1_release_notes#3130296)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [smartbanner.js](https://github.com/ain/smartbanner.js/issues/new)","status":"published","published":"2019-09-13T13:22:33Z","modified":"2025-02-18T18:27:08Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"}],"cwes":["CWE-79","CWE-601"],"updated_at":"2026-11-02T14:38:32.275316Z"}],"nvd":[{"id":"CVE-2025-25300","description":"smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile third parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner. `rel=\"noopener\"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure `View` link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If `View` link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel=\"noopener\"` is imposed on all `target=\"_blank\"` links. Version 1.14.1 of smartbanner.js contains a fix for the issue.","status":"published","published":"2025-02-18T18:15:35.33Z","modified":"2026-06-17T09:00:38.68Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-79","CWE-601"],"updated_at":"2026-11-02T14:10:51.445921Z"}],"osv":[{"id":"CVE-2025-25300","title":"smartbanner.js rel noopener XSS vulnerability","description":"smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile third parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner. `rel=\"noopener\"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure `View` link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If `View` link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel=\"noopener\"` is imposed on all `target=\"_blank\"` links. Version 1.14.1 of smartbanner.js contains a fix for the issue.","status":"published","published":"2025-02-18T17:38:52.088Z","modified":"2026-10-28T02:30:35.949901952Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"GHSA-9mrq-cjgh-32g2","title":"smartbanner.js rel noopener vulnerability","description":"## rel noopener vulnerability\n\n### Impact\nClicking on smartbanner _View_ link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile 3rd parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner.\n\n### Patches\n`rel=\"noopener\"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability.\n\n### Workarounds\nIf you can not upgrade to `v1.14.1`:\n1. Ensure _View_ link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams\n2. If _View_ link is going to a 3rd party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel=\"noopener\"` is imposed on all `target=\"_blank\"` links.\n\n    Following combination of smartbanner meta tags can be used to achieve the above:\n\n    ```html\n    \u003cmeta name=\"smartbanner:enabled-platforms\" content=\"none\"\u003e\n    \u003cmeta name=\"smartbanner:include-user-agent-regex\" content=\"Mobile.*Safari\"\u003e\n    ```\n\n### References\n* [About rel=noopener](https://mathiasbynens.github.io/rel-noopener/)\n* [Safari 12.1 Release Notes](https://developer.apple.com/documentation/safari_release_notes/safari_12_1_release_notes#3130296)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [smartbanner.js](https://github.com/ain/smartbanner.js/issues/new)","status":"published","published":"2019-09-13T13:22:33Z","modified":"2026-09-10T03:48:45.068645505Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}