validator.js has a URL validation bypass vulnerability in its isURL function

🗓️ 30 Sep 2025 18:30:25Reported by GitHub Advisory DatabaseType

Validator.js isURL bypass in v13.15.15 allows protocol and domain bypass, enabling cross site scripting.

Reporter	Title	Published	Views	Family All 33
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Processing	5 Jan 202611:20	–	ibm
IBM Security Bulletins	Security Bulletin: User Entity Behavior Analytics App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	28 Jan 202615:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java and Node.js	26 Nov 202510:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub	17 Nov 202514:59	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials (CVE-2025-56200, CVE-2025-64118, CVE-2025-59343)	9 Jan 202600:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java and Node.js	26 Nov 202510:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Endpoint Management is affected by multiple vulnerabilities.	5 Jan 202611:13	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in validator.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	29 Dec 202507:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D	24 Mar 202621:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to URL validation bypass [CVE-2025-56200]	26 Nov 202516:34	–	ibm

Vulners

Node

validator_project validatorRange<13.15.20npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-56200
gist	www.gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666
gist	www.gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596
github	www.github.com/validatorjs/validator.js
validatorjs	www.validatorjs.com/
github	www.github.com/validatorjs/validator.js/issues/2600
github	www.github.com/validatorjs/validator.js/pull/2608
github	www.github.com/validatorjs/validator.js/commit/cbef5088f02d36caf978f378bb845fe49bdc0809
github	www.github.com/validatorjs/validator.js/releases/tag/13.15.20
github	www.github.com/advisories/GHSA-9965-vmph-33xx

27 Oct 2025 12:53Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.1

EPSS0.0005

SSVC

CWE-79