Common Weakness Enumeration
CWE-1022 Use of Web Link to Untrusted Target with window.opener Access
Description
The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1022 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-vvfj-2jqx-52jm | CVE-2025-59842 | LOW |
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute |
2025-09-26 | |
| GHSA-xcxh-6cv4-q8p8 | - | LOW |
HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit |
2025-08-12 | |
| GHSA-m688-cx2p-rgq9 | CVE-2018-25058 | MODERATE |
Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access |
2023-01-09 | |
| GHSA-74hc-57m5-83ch | CVE-2020-36624 | MODERATE |
text_helpers uses web link to untrusted target with window.opener access |
2022-12-29 | |
| GHSA-h6mq-3cj6-h738 | - | LOW |
Reverse Tabnabbing in showdown |
2021-10-01 | |
| GHSA-588m-9qg5-35pq | - | MODERATE |
Reverse Tabnabbing in quill |
2021-09-28 | |
| GHSA-x9p2-fxq6-2m5f | - | MODERATE |
Reverse Tabnapping in swagger-ui |
2021-08-16 |