CVE-2025-56200
mediumpriority · track · 0EPSS 0.003 · 25 %ileDEEUUSEPSS · scored 2026-10-27
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-2681IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2025-11-25csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen und Cross-Site-Scripting- oder Open-Redirect-Angriffe durchzuführen, einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
- GHSA-9965-vmph-33xxvalidator.js has a URL validation bypass vulnerability in its isURL function2025-09-30ghsa · osvUS
A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- http://validatorjs.comcnnvd
- https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666cnnvd
- https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596cnnvd
- https://github.com/validatorjs/validator.jscnnvd
- https://vigilance.fr/vulnerability/Validator-js-Cross-Site-Scripting-via-isURL-49508cnnvd
- https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666enisa_euvd
- https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596enisa_euvd
- https://github.com/validatorjs/validator.jsenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan