CVE-2022-25839: Improper Input Validation in url-js

March 11, 2022 (updated March 22, 2022)

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.

References

github.com/advisories/GHSA-rf54-44jr-q5vf
github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0
nvd.nist.gov/vuln/detail/CVE-2022-25839
snyk.io/vuln/SNYK-JS-URLJS-2414030

Detect and mitigate CVE-2022-25839 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →