~ / search / GHSA-9965-vmph-33xx

GHSA-9965-vmph-33xx

validator.js has a URL validation bypass vulnerability in its isURL function

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-56200

Packages

EcosystemPackageAffectedFixed in
npm validator < 13.15.20 13.15.20

Details

As written in the advisory (Markdown source, shown as plain text).

A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.

References

External links from the advisory. They lead to third-party sites.