Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-25300

CVE-2025-25300: smartbanner.js rel noopener vulnerability

5.3

CVSS Score
4.0

Basic Information

CVE ID
CVE-2025-25300
GHSA ID
GHSA-9mrq-cjgh-32g2
EPSS Score
0.26845%
CWE
CWE-79
Published
9/13/2019
Updated
2/18/2025
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Package NameEcosystemVulnerable VersionsFirst Patched Version
smartbanner.jsnpm< 1.14.11.14.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from anchor tags created without rel='noopener' in the smartbanner template. The commit fce8c31 shows the fix was adding rel='noopener' to the <a> element in src/smartbanner.js. The template generation function (likely part of SmartBanner.render) is directly responsible for creating vulnerable links. Test file updates confirm this was the only code change required to resolve the issue.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## r*l noop*n*r vuln*r**ility ### Imp**t *li*kin* on sm*rt**nn*r _Vi*w_ link *n* n*vi**tin* to *r* p*rty p*** l**v*s `win*ow.op*n*r` *xpos**. It m*y *llow *ostil* *r* p*rti*s to **us* `win*ow.op*n*r`, *.*. *y r**ir**tion or inj**tion on t** ori*in*l

Reasoning

T** vuln*r**ility st*ms *rom *n**or t**s *r**t** wit*out r*l='noop*n*r' in t** sm*rt**nn*r t*mpl*t*. T** *ommit ******* s*ows t** *ix w*s ***in* r*l='noop*n*r' to t** `<*>` *l*m*nt in `sr*/sm*rt**nn*r.js`. T** t*mpl*t* **n*r*tion *un*tion (lik*ly p*r