CVE-2022-0613

CVE-2022-0613 affects the urijs (URI.js) npm package prior to 1.19.8. The issue is described as an Authorization Bypass Through User-Controlled Key, with related sources noting that the URI.js library could bypass host validation and enable open Redirect/SSRF scenarios. The vulnerability is assoc...

CVE-2022-24723

CVE-2022-24723 concerns Medialize URI.js, a JavaScript URL mutation library. The vulnerability arises from leading whitespace not being removed from the beginning of the protocol, causing improper URL parsing in versions prior to 1.19.9. The issue has been patched in v1.19.9; a documented workaro...

CVE-2020-26291

CVE-2020-26291 affects the URI.js (urijs) library. In versions before 1.19.4, a hostname spoof can be performed by a backslash followed by an at character, potentially defeating security decisions and enabling bypasses of allow/block lists, SSRF, or open redirects depending on usage. Patched in 1...

CVE-2022-1243

CVE-2022-1243 concerns the medialize/uri.js library. The issue, caused by CRHTLF, can lead to invalid protocol extraction and potential cross‑site scripting (XSS) when processing user‑supplied URLs in uri.js prior to version 1.19.11. The vulnerability affects medialize/uri.js used by projects suc...

CVE-2021-3647

CVE-2021-3647 affects Medialize URI.js (Node.js) and enables URL redirection to untrusted sites due to input/URL parsing validation issues in URI.js. Public details describe an open redirect vulnerability; Nessus/Huntr materials note unpatched deployments and indicate a bypass possibility in patc...

CVE-2022-0868

CVE-2022-0868 is an open redirect in medialize/uri.js prior to 1.19.10. Open redirect could allow a remote attacker to redirect victims to arbitrary sites via crafted URLs. Public metrics show base scores around 5.8–6.1 (NVD) and up to 8.0 in some sources depending on scope/age. Remediation: upgr...

CVE-2021-27516

CVE-2021-27516 affects the URI.js (urijs) library prior to v1.19.6. The issue stems from how the library handles backslashes in the URL delimiter (e.g., https:/...), which can cause hostname spoofing and misinterpretation of the target hostname, potentially enabling SSRF, open redirects, or relat...

CVE-2022-1233

CVE-2022-1233 affects the medialize/uri.js library. When parsing URLs without a scheme and with excessive slashes, the library may treat the hostname as null and set the path to /www.example.com, leading to URL confusion. This issue is fixed in version 1.19.11; prior releases are vulnerable. Affe...