npm/urijs CVE-2021-3647: medium 5.3, EPSS 0.91%

URIjs Vulnerable to Hostname spoofing via backslashes in URL

Action: Upgrade urijs to 1.19.7 or later.

npm i urijs@1.19.7

Affected

Fixed versions

Sources

• osv: GHSA-89gv-h8wf-cg8r
• https://github.com/medialize/URI.js/security/advisories/GHSA-89gv-h8wf-cg8r
• https://nvd.nist.gov/vuln/detail/CVE-2021-3647
• https://github.com/medialize/URI.js/pull/233
• https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481
• https://github.com/medialize/URI.js/releases/tag/v1.19.3
• https://github.com/medialize/URI.js/releases/tag/v1.19.4
• https://github.com/medialize/URI.js/releases/tag/v1.19.6
• https://github.com/medialize/URI.js/releases/tag/v1.19.7
• https://huntr.dev/bounties/1625558772840-medialize/URI.js

CVE-2021-3647 · published 2021-07-19T21:22:36Z · modified 2023-11-08T04:06:14.577916Z · JSON