CVE-2022-25839: Improper Input Validation in url-js

March 11, 2022 (updated March 22, 2022)

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.

References

github.com/advisories/GHSA-rf54-44jr-q5vf
github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0
nvd.nist.gov/vuln/detail/CVE-2022-25839
snyk.io/vuln/SNYK-JS-URLJS-2414030

Code Behaviors & Features

Detect and mitigate CVE-2022-25839 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →