Description
Versions of validator prior to 2.0.0 contained an xss filter method that is affected by several filter bypasses. This may result in a cross-site scripting vulnerability.
Recommendation
Update the validator package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.0
- Patched version(s): 2.0.0
References
Could your website be exposed too?
SmartScanner can check your website for XSS Filter Bypass via Encoded URL in validator and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
- @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation - CVE-2026-26019
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023