MEDIUM5.3

GHSA-rf54-44jr-q5vf

Improper Input Validation in url-js

Quick fix

GHSA-rf54-44jr-q5vf — url-js: upgrade to the fixed version with the command below.

npm install url-js@2.1.0

Details

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/url-js

Introduced in: 0Fixed in: 2.1.0

Fixnpm install url-js@2.1.0

References

https://nvd.nist.gov/vuln/detail/CVE-2022-25839[ADVISORY]
https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0[WEB]
https://github.com/duzun/URL.js[PACKAGE]
https://snyk.io/vuln/SNYK-JS-URLJS-2414030[WEB]