{"cve":"CVE-2025-56200","nvd":{"published":"2025-09-30T18:15:50.307","modified":"2026-07-05T02:16:58.160","status":"Modified","description":"A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666","https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596","https://github.com/validatorjs/validator.js"],"products":["validator_project:validator"],"source":"nvd","synced_at":"2026-10-19T22:11:26.888974865+00:00"},"epss":{"cve":"CVE-2025-56200","score":0.00324,"percentile":0.25511,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9965-vmph-33xx","url":"https://osv.dev/vulnerability/GHSA-9965-vmph-33xx","summary":"validator.js has a URL validation bypass vulnerability in its isURL function","modified":"2026-09-10T03:50:28.187015105Z","packages":[{"ecosystem":"npm","name":"validator","purl":"pkg:npm/validator","ranges":["<13.15.20"],"fixed":["13.15.20"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}