GHSA-JF5R-8HM2-F872 url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.

🗓️ 22 Feb 2022 00:00:30Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

Leading control characters are not stripped by url-parse, risking incorrect URL parsing and XSS.

Reporter	Title	Published	Views	Family All 38
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System.	16 Aug 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties in Open Source packages affects IBM Watson Machine Learning Accelerator on Cloud Pak for Data	6 Dec 202316:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security is vulnerable to Using Components with Known Vulnerabilities	25 Jul 202213:54	–	ibm
IBM Security Bulletins	Security Bulletin: Medium/low severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:51	–	ibm
Huntr	Authorization Bypass Through User-Controlled Key	19 Feb 202204:00	–	huntr
ATTACKERKB	CVE-2022-0691	21 Feb 202209:15	–	attackerkb
Circl	CVE-2022-0691	21 Feb 202212:41	–	circl
CNNVD	Unshiftio Url-parse 访问控制错误漏洞	21 Feb 202200:00	–	cnnvd
CVE	CVE-2022-0691	21 Feb 202200:00	–	cve
Cvelist	CVE-2022-0691 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	21 Feb 202200:00	–	cvelist

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-0691
github	www.github.com/github/advisory-database/pull/6765
github	www.github.com/unshiftio/url-parse/commit/0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63
github	www.github.com/unshiftio/url-parse
huntr	www.huntr.dev/bounties/57124ed5-4b68-4934-8325-2c546257f2e4
lists	www.lists.debian.org/debian-lts-announce/2023/02/msg00030.html
security	www.security.netapp.com/advisory/ntap-20220325-0006

03 Feb 2026 22:19Current

7High risk

Vulners AI Score7

CVSS 36.5

EPSS0.0222

leading control characters url parsing security decisions cross site scripting javascript protocol