Use of Web Link to Untrusted Target with window.opener Access Affecting hfs package, versions <0.57.10-beta1
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-HFS-11787824
- published13 Aug 2025
- disclosed12 Aug 2025
- creditByteAfterlife
Introduced: 12 Aug 2025
New CVE NOT AVAILABLE CWE-1022 (opens in a new tab)How to fix?
Upgrade hfs to version 0.57.10-beta1 or higher.
Overview
hfs is a HTTP File Server
Affected versions of this package are vulnerable to Use of Web Link to Untrusted Target with window.opener Access via the openFileMenu function in the fileMenu.ts file. An attacker can manipulate the content of the original browser tab by exploiting the window.opener property after a user clicks a crafted external link, potentially leading to credential theft or exposure of sensitive information.
Note: This is only exploitable if users access the application using outdated browsers that do not mitigate this issue at the browser level.