| Package | Affected versions | Patched versions |
|---|---|---|
| url-js | < 2.1.0 | 2.1.0 |
| url-js | < 2.1.0 | 2.1.0 |
The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free