En bref
- CVE-2025-56200 est une vulnérabilité MOYENNE (CVSS 6.1) touchant validator (validator project), validator.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.32%, plus élevée que 25.5% des vulnérabilités.
- Correctif : mettre à jour vers 13.15.20 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| validator | ≤ 3.15.15
| No fix yet |
| validator npm | < 13.15.20
| 13.15.20
|
Description
A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
NVD description
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free