Authorization Bypass in parse-path

Description

Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.

Recommendation

Update the parse-path package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.0.0
• Patched version(s): 5.0.0

References

• GHSA-3j8f-xvm3-ffx4
• huntr.dev
• CVE-2022-0624
• CWE-639
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Authorization bypass in url-parse - CVE-2022-0512
• Authorization Bypass Through User-Controlled Key in url-parse - CVE-2022-0686
• Authorization Bypass Through User-Controlled Key in urijs - CVE-2022-0613
• Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - nitro - CVE-2026-44373

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

parse-path