GHSA-rf54-44jr-q5vfMediumCVSS 5.3

Improper Input Validation in url-js

Published
March 12, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-25839 →

📋 Description

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.

🎯 Affected products1

  • npm/url-js:< 2.1.0

🔗 References (4)