In short
- CVE-2022-25839 is a MEDIUM (CVSS 5.3) vulnerability affecting url-js (url-js project), url-js.
- Chance of exploitation in the next 30 days (EPSS): 0.85%, higher than 58.4% of all vulnerabilities.
- Fix: update to 2.1.0 or later.
| Package | Affected versions | Patched versions |
|---|
| url-js | < 2.1.0
| 2.1.0
|
| url-js npm | < 2.1.0
| 2.1.0
|
Description
The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
NVD description
The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free