LIFF SDK XSS vulnerability disclosure and usage restrictions on older versions

LINE DevelopersSecurityDeadline Nov 24, 2026

Due to an XSS vulnerability in older LIFF SDK versions, LINE plans to restrict the use of affected versions in external browsers.

Required action

If you use LIFF v2.20.0 through v2.31.0 via a fixed CDN path or the @line/liff npm package, update to LIFF v2.31.1 or later (latest is v2.31.2) immediately.

Changes

  • A cross-site scripting vulnerability (CVE-2026-112148) was confirmed in LIFF v2.20.0 through v2.31.0.
  • Opening an endpoint URL from a malicious URL in an external or LINE in-app browser may allow arbitrary JavaScript execution.
  • Usage restrictions on LIFF v2.20.0 through v2.31.0 are scheduled around November 24, 2026, and may be moved up without notice.
  • After the restriction, LINE Login and other LIFF features may stop working when opening affected apps in external browsers.
  • Apps using the CDN edge path (https://static.line-scdn.net/liff/edge/2/sdk.js) are automatically updated to v2.31.2 and need no action.

Affected areas

LIFF v2.20.0 〜 v2.31.0@line/liffhttps://static.line-scdn.net/liff/edge/2/sdk.jshttps://static.line-scdn.net/liff/edge/versions/2.31.2/sdk.jsCVE-2026-112148

Open official page

This summary is independently created by Release Radar and is not an official announcement from the vendor. Please read the official page for accurate details.

More updates