Fluid Attacks Database

Description

Improper Validation and Sanitization in url-parse Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	url-parse	>=0.1.0 <1.4.5	1.4.5
debian 12	node-url-parse	>=0 <1.4.7-1	1.4.7-1
debian 11	node-url-parse	>=0 <1.4.7-1	1.4.7-1
debian 14	node-url-parse	>=0 <1.4.7-1	1.4.7-1
debian 13	node-url-parse	>=0 <1.4.7-1	1.4.7-1

Aliases

1. CVE-2020-81242. NVD-2020-81243. OSV-2020-81244. OSV-DEBIAN-2020-81245. GCVE-2020-81246. SECURITY-TRACKER-CVE-2020-8124

References

1. https://github.com/github/advisory-database/pull/67622. https://github.com/unshiftio/url-parse/commit/3ecd256f127c3ada36a84d9b8dd3ebd14316274b3. https://hackerone.com/reports/496293

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.