GHSA-rf54-44jr-q5vf

Improper Input Validation in url-js

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25839

Packages

Ecosystem	Package	Affected	Fixed in
npm	url-js	< 2.1.0	2.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25839 advisory
https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0 web
https://github.com/duzun/URL.js package
https://snyk.io/vuln/SNYK-JS-URLJS-2414030 web