CVE-2025-56200

Katalog CVE

CVSS 6.1 · Medium EPSS 0,32%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada validator project validator. Skor CVSS 3.1 6.1 (Medium) menurut CISA ADP.

Deskripsi (NVD)

A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.

Rincian

Terbit di NVD

30 September 2025

Terakhir diubah

5 Juli 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666 exploit · advisory pihak ketiga
• https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596 exploit · advisory pihak ketiga
• https://github.com/validatorjs/validator.js product