CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2025-56200
Medium (6.1) in validator project validator. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in validator 13.15.20.
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- validator_project:validator
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9965-vmph-33xx | npm | validator | <13.15.20 | 13.15.20 |