Description
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation.
Recommendation
Update the validator package to the latest compatible version. Followings are version details:
- Affected version(s): < 13.15.22
- Patched version(s): 13.15.22
References
Could your website be exposed too?
SmartScanner can check your website for Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements and gives you actionable findings to investigate.
Start a free scanRelated Issues
- AngularJS Incomplete Filtering of Special Elements vulnerability - CVE-2025-2336
- AngularJS improperly sanitizes SVG elements - CVE-2025-0716
- Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - CVE-2025-27793
- @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params - CVE-2025-32388
You might also like:
See something that needs correcting? Let us knowUpdated January 31, 2026