Skip to content
Fencer Vulns
medium 4.2

CVE-2018-25058 json

Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing

published 2022-12-29 3 y ago modified 2026-06-17 4 mo ago also GHSA-m688-cx2p-rgq9 , EUVD-2022-7679

cvss
4.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 is able to address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.

Patch / fix

  • npm twitter-fetcher-js 18.0.0
  • twitter-post-fetcher_project twitter-post-fetcher 18.0.0

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
CNA 3.0 4.2 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm twitter-fetcher-js
<18.0.0
18.0.0

Affected products

  • n/a Twitter-Post-Fetcher

Classification

Weakness
  • CWE-1022 Use of Web Link to Untrusted Target with window.opener Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.