Skip to main content
cve.nowby Sazabi
← npm
npmPackage

urijs

8 known vulnerabilities (2 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 high, 5 medium
Registry
npm

Advisories 8

  • CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js

    Affected: fixed in 1.19.11.

  • CVE-2022-1233Medium 6.5

    URL Confusion When Scheme Not Supplied in medialize/uri.js

    Affected: fixed in 1.19.11.

  • Open Redirect in medialize/uri.js

    Affected: fixed in 1.19.10.

  • CVE-2022-24723Medium 5.3

    Improper Input Validation in URI.js

    Affected: fixed in 1.19.9.

  • CVE-2022-0613Medium 5.3

    Authorization Bypass Through User-Controlled Key in medialize/uri.js

    Affected: fixed in 1.19.8.

  • CVE-2021-3647Medium 5.3

    Open Redirect in medialize/URI.js

    Affected: fixed in 1.19.7.

  • URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

    Affected: fixed in 1.19.6.

  • CVE-2020-26291Medium 6.5

    Hostname spoofing in URI.js

    Affected: fixed in 1.19.4.