1vulnerability
- Critical1 (100.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
capacitor-ios
Ecosystem: npm
Downloads:
- 1CriticalAffects 5 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting capacitor-ios, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-rvm3-566m-v7fv | Critical | Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the native layer to fetch an arbitrary, caller-specified URL and return the response body to the WebView **at the app's own origin**. Script in that response then ran with full same-origin trust: access to `localStorage`, cookies, and every nati |
| GitHub (opens in a new tab) |
- GHSA-rvm3-566m-v7fvCriticalCapacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
>= 6.0.0, < 6.2.2>= 7.0.0, < 7.6.9- +3 more
Affected versions:>= 6.0.0, < 6.2.2>= 7.0.0, < 7.6.9>= 8.5.0, < 8.5.1>= 8.3.5, < 8.4.3>= 8.0.0, <= 8.3.4
### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the native layer to fetch an arbitrary, caller-specified URL and return the response body to the WebView **at the app's own origin**. Script in that response then ran with full same-origin trust: access to `localStorage`, cookies, and every nati
CVE: CVE-2026-103922