Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1022: Use of Web Link to Untrusted Target with window.opener Access

Variant Incomplete

The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Specify in the design that any linked external document must not be granted access to the location object of the calling page.

  2. Implementation

    When creating a link to an external document using the <a> tag with a defined target, for example "_blank" or a named frame, provide the rel attribute with a value "noopener noreferrer".

    If opening the external document in a new window via javascript, then reset the opener by setting it equal to null.

  3. Implementation

    Do not use "_blank" targets. However, this can affect the usability of the application.

Source: MITRE CWE-1022

All Critical High Medium Low Exploited only Public exploit

18 results · Feed

  • Medium 6.1
    CVE-2025-27902

    IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure

    IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web …

    IBM DB2 Recovery Expert for Linux, UNIX and Windows Linux Windows
  • Medium 4.1
    CVE-2026-71555

    PILOS: Reverse tabnabbing in room description

    PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., targ…

    THM-Health PILOS
  • Low 2.1
    CVE-2025-59842

    JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

    jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Noteb…

    jupyterlab jupyterlab jupyterlab jupyterlab Debian Ubuntu PyPI
  • Low 3.5
    CVE-2025-42941

    Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)

    SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link (<a>) elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pa…

    SAP_SE SAP Fiori Launchpad
  • Low —
    GHSA-xcxh-6cv4-q8p8

    HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit

    ### Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with `target="_blank"` but without the `rel="noopener noreferrer"` attribute. This allows the opened page to use the `window.opener` property to change the location of t…

    hfs npm
  • Medium 5.4
    CVE-2025-33014

    IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection

    IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or …

    IBM Sterling B2B Integrator Sterling File Gateway
  • Medium 6.1
    CVE-2024-39727

    IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing

    IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on …

    IBM Engineering Insights
  • Low 3.5
    CVE-2018-25089

    glb Meetup Tag Extension Link Attribute reverse tabnabbing

    A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with wi…

    glb Meetup Tag Extension
  • Medium 5.5
    CVE-2022-4927

    ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbing

    A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/_refworks.html.erb. The manipulation leads to use of web link to untrusted target with wind…

    ualbertalib NEOSDiscovery
  • Medium 4.2
    CVE-2018-25058

    Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing

    A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with…

    twitter-fetcher-js npm
  • Medium 6.3
    CVE-2020-36624

    ahorner text-helpers translation.rb reverse tabnabbing

    A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted t…

    ahorner text-helpers text_helpers RubyGems
  • Unscored —
    CVE-2022-2600

    Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing

    The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.

    Web / CMS
  • Unscored —
    CVE-2022-1583

    External Links in New Window / New Tab < 1.43 - Tabnabbing

    The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.

    Web / CMS
  • Medium 4.7
    CVE-2021-33697

    Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow a…

    SAP_SE SAP BusinessObjects Business Intelligence Platform (SAPUI5)
  • Unscored —
    CVE-2021-39112

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL …

    Atlassian Jira Server Jira Data Center Web / CMS
  • Low 3.1
    GHSA-h6mq-3cj6-h738

    Reverse Tabnabbing in showdown

    Versions of `showdown` prior to 1.9.1 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when openin…

    showdown npm
  • Medium 6.5
    GHSA-588m-9qg5-35pq

    Reverse Tabnabbing in quill

    Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening l…

    quill npm
  • Medium 4.3
    GHSA-x9p2-fxq6-2m5f

    Reverse Tabnapping in swagger-ui

    Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is…

    swagger-ui npm