Sicherheitslücken in github.com/ionic-team/capacitor-swift-pm

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected

• Auf 6.2.2 aktualisieren
• Auf 7.6.9 aktualisieren
• Auf 8.4.3 aktualisieren
• Auf 8.5.1 aktualisieren