Description
Versions of validator prior to 2.0.0 contained an xss filter method that is affected by several filter bypasses. This may result in a cross-site scripting vulnerability.
Recommendation
Update the validator package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.0
- Patched version(s): 2.0.0
References
- GHSA-79mx-88w7-8f7q
- www.npmjs.com
- www.openwall.com
- www.securityfocus.com
- CVE-2014-9772
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - CVE-2025-26619
- Multiple XSS Filter Bypasses in validator - CVE-2013-7454
- Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 - CVE-2025-66202
- Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass - CVE-2025-64525
- Tags:
- npm
- validator
Anything's wrong? Let us know Last updated on January 09, 2023