Description
A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses ‘://’ as a delimiter to parse protocols, while browsers use ‘:’ as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
Recommendation
Update the validator package to the latest compatible version. Followings are version details:
- Affected version(s): < 13.15.20
- Patched version(s): 13.15.20
References
Could your website be exposed too?
SmartScanner can check your website for validator.js has a URL validation bypass vulnerability in its isURL function and gives you actionable findings to investigate.
Start a free scanRelated Issues
- MCPHub has an Improper Authorization vulnerability via its handleSseConnection function - CVE-2025-11287
- BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability - CVE-2025-69287
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-azure - CVE-2026-34750
- @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation - CVE-2026-26019
You might also like:
See something that needs correcting? Let us knowUpdated October 27, 2025