Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11. This can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or Javascript (see following example):
Recommended action: Upgrade to 1.19.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Medialize is a Javascript URL mutation library. When parsing a URL without a scheme and with excessive slashes, like ///www.example.com, URI.js will parse the hostname as null and the path as /www.example.com. Such behaviour is different from that exhibited by browsers, which will parse ///www.example.com as http://www.example.com instead. For example, the following will cause a redirect to http://www.example.com: A fix was released in version 1.19.11.
Recommended action: Upgrade to 1.19.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
urijs prior to version 1.19.10 is vulnerable to open redirect. This is the result of a bypass for the fix to CVE-2022-0613.
Recommended action: Upgrade to 1.19.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail. Patches Patched in 1.19.9 Workarounds Remove leading whitespace from values before passing them to URI.parse (e.g. via .href(value) or new URI(value)), e.g. by using References https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/ For more information If you have any questions or comments about this advisory: Open an issue in medialize/URI.js
Recommended action: Upgrade to 1.19.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.
Recommended action: Upgrade to 1.19.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (\) and slash (/) characters as part of the scheme delimiter, e.g. scheme:/\/\/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. Example URL: https:/\/\/\expected-example.com/path Escaped string: https:/\\/\\/\\expected-example.com/path (JavaScript strings must escape backslash) Affected versions incorrectly return no hostname. Patched versions correctly return expected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Patches Version 1.19.7 is patched against all known payload variants. References https://github.com/medialize/URI.js/releases/tag/v1.19.7…
Recommended action: Upgrade to 1.19.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash (\) character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. Example URL: https:/\expected-example.com/path Escaped string: https:/\\expected-example.com/path (JavaScript strings must escape backslash) Affected versions incorrectly return no hostname. Patched versions correctly return expected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Patches Version 1.19.6 is patched against all known payload variants. References https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for this particular bypass)…
Recommended action: Upgrade to 1.19.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash (\) character followed by an at (@) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. Example URL: https://expected-example.com\@observed-example.com Escaped string: https://expected-example.com\\@observed-example.com (JavaScript strings must escape backslash) Affected versions incorrectly return observed-example.com. Patched versions correctly return expected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Patches Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant. References…
Recommended action: Upgrade to 1.19.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.