A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
References
| Link | Resource |
|---|---|
| http://validatorjs.com | Broken Link |
| https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666 | Exploit Third Party Advisory |
| https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596 | Exploit Third Party Advisory |
| https://github.com/validatorjs/validator.js | Product |
Configurations
History
18 Oct 2025, 01:48
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:validator_project:validator:*:*:*:*:*:node.js:*:* | |
| First Time |
Validator Project validator
Validator Project |
|
| References | () http://validatorjs.com - Broken Link | |
| References | () https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666 - Exploit, Third Party Advisory | |
| References | () https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596 - Exploit, Third Party Advisory | |
| References | () https://github.com/validatorjs/validator.js - Product |
30 Sep 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
30 Sep 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-30 18:15
Updated : 2025-10-18 01:48
NVD link : CVE-2025-56200
Mitre link : CVE-2025-56200
CVE.ORG link : CVE-2025-56200
JSON object : View
Products Affected
validator_project
- validator
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')