# CVE-2020-11611: xdLocalStorage open redirect via unsafe postMessage targetOrigin

Source: https://junglewise.ai/threats/cve-2020-11611-xdlocalstorage-open-redirect-via-unsafe-postmessage-targetorigin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-11611 · Severity: low · CVSS 3.1 · Published 2021-12-09

xdLocalStorage is a JavaScript library that enables web applications to share data across different domains using cross-origin communication. The library's buildMessage() function uses a wildcard (*) as the targetOrigin when sending messages via postMessage(), allowing any domain loaded in an iframe to intercept sensitive messages intended for cross-domain storage operations. This misconfiguration could enable attackers to redirect users or intercept stored data.

Technologies: [xdlocalstorage (npm)](https://junglewise.ai/threats/technologies/xdlocalstorage). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-11611 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-11611 being exploited in the wild.

**How severe is CVE-2020-11611?** Low severity, with a CVSS score of 3.1, published 9 December 2021.

**Which products and versions are affected?** xdlocalstorage (npm) SEMVER:introduced=0,last_affected=2.0.5.

**Is there a fix for CVE-2020-11611?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-11611 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-11611?** Check whether you run xdlocalstorage (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an open redirect / insecure postMessage implementation (CWE-601) in the xdLocalStorage library through version 2.0.5. The root cause is that the buildMessage() function specifies a wildcard (*) as the targetOrigin parameter in postMessage() calls to iframe objects, rather than restricting messages to a specific trusted origin. This allows any domain currently loaded within the iframe to receive and potentially act upon messages from the client. An attacker with control over a domain loaded in a framed context could intercept these messages or trigger unintended navigation. No special authentication or unusual user interaction is required beyond normal library usage, though the attacker must control the iframe's loaded domain. The fix is to replace the wildcard with an explicit, trusted targetOrigin value.

## Affected products

- ofirdagan xdLocalStorage through 2.0.5

## Identifiers

- CVE-2020-11611
- GHSA-c6c4-jmqx-3r33

## Timeline

- 2021-12-09: disclosed
- 2020-04-07: advisory: NVD publication date

## References

- [https://github.com/ofirdagan/cross-domain-local-storage](https://github.com/ofirdagan/cross-domain-local-storage)

## Related threats

- [xdlocalstorage missing request origin verification](https://junglewise.ai/threats/cve-2020-11610-xdlocalstorage-missing-request-origin-verification)
- [xdLocalStorage improper input validation in origin verification](https://junglewise.ai/threats/cve-2015-9545-xdlocalstorage-improper-input-validation-in-origin-verification)
- [xdLocalStorage improper input validation in postMessage handler](https://junglewise.ai/threats/cve-2015-9544-xdlocalstorage-improper-input-validation-in-postmessage-handler)