Description
Medialize is a Javascript URL mutation library. When parsing a URL without a scheme and with excessive slashes, like ///www.example.com, URI.js will parse the hostname as null and the path as /www.example.com. Such behaviour is different from that exhibited by browsers, which will parse ///www.example.com as http://www.example.com instead.
Recommendation
Update the urijs package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.19.11
- Patched version(s): 1.19.11
References
Could your website be exposed too?
SmartScanner can check your website for URL Confusion When Scheme Not Supplied in medialize/uri.js and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Hostname confusion in parse-url - CVE-2022-0722
- Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity - CVE-2026-31873
- Hostname spoofing via backslashes in URL - CVE-2020-26291
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023