https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:28:43 +0000 https://cve.radiocsirt.org/vuln/certfr-2022-avi-345 certfr-2022-avi-345 https://cve.radiocsirt.org/vuln/certfr-2022-avi-345 https://cve.radiocsirt.org/vuln/euvd-2026-46019 EUVD-2026-46019 https://cve.radiocsirt.org/vuln/euvd-2026-46019 https://cve.radiocsirt.org/vuln/fkie_cve-2020-26291 <p>URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node&#39;s built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]</p> <p>URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node&#39;s built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-26291 https://cve.radiocsirt.org/vuln/ghsa-3329-pjwv-fjpg <p><strong>Affected:</strong> npm: urijs</p> <p>### Impact If using affected versions to determine a URL&#39;s hostname, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect.</p> <p>Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.</p> <p>Example URL: `https://expected-example.com\@observed-example.com` Escaped string: `https://expected-example.com\\@observed-example.com` (JavaScript strings must escape backslash)</p> <p>Affected versions incorrectly return `observed-example.com`. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node&#39;s built-in URL class](https://nodejs.org/api/url.html).</p> <p>### Patches Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.</p> <p>### References https://github.com/medialize/URI.js/releases/tag/v1.19.4 (complete fix for this bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.3 (partial fix for this bypass) [PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)</p> <p>### For more information If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js…</p> <p><strong>Affected:</strong> npm: urijs</p> <p>### Impact If using affected versions to determine a URL&#39;s hostname, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect.</p> <p>Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.</p> <p>Example URL: `https://expected-example.com\@observed-example.com` Escaped string: `https://expected-example.com\\@observed-example.com` (JavaScript strings must escape backslash)</p> <p>Affected versions incorrectly return `observed-example.com`. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node&#39;s built-in URL class](https://nodejs.org/api/url.html).</p> <p>### Patches Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.</p> <p>### References https://github.com/medialize/URI.js/releases/tag/v1.19.4 (complete fix for this bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.3 (partial fix for this bypass) [PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)</p> <p>### For more information If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js…</p> https://cve.radiocsirt.org/vuln/ghsa-3329-pjwv-fjpg https://cve.radiocsirt.org/vuln/gsd-2020-26291 gsd-2020-26291 https://cve.radiocsirt.org/vuln/gsd-2020-26291 https://cve.radiocsirt.org/vuln/rhsa-2021:3917 <p>nodejs-debug: Regular expression Denial of Service nodejs-mime: Regular expression Denial of Service nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js lodash: Prototype pollution in utilities function hoek: Prototype pollution in utilities function nodejs-url-parse: incorrect hostname in url parsing nodejs-extend: Prototype pollution can allow attackers to modify object properties nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS lodash: uncontrolled resource consumption in Data handler causing denial of service nodejs-yargs-parser: prototype pollution vulnerability nodejs-lodash: prototype pollution in zipObjectDeep function nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function nodejs-highlight-js: prototype pollution via a crafted HTML code block urijs: Hostname spoofing via backslashes in URL python-pillow: Buffer over-read in PCX image reader python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) nodejs-postcss: Regular expression denial of service during source map parsing no…</p> <p>nodejs-debug: Regular expression Denial of Service nodejs-mime: Regular expression Denial of Service nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js lodash: Prototype pollution in utilities function hoek: Prototype pollution in utilities function nodejs-url-parse: incorrect hostname in url parsing nodejs-extend: Prototype pollution can allow attackers to modify object properties nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS lodash: uncontrolled resource consumption in Data handler causing denial of service nodejs-yargs-parser: prototype pollution vulnerability nodejs-lodash: prototype pollution in zipObjectDeep function nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function nodejs-highlight-js: prototype pollution via a crafted HTML code block urijs: Hostname spoofing via backslashes in URL python-pillow: Buffer over-read in PCX image reader python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) nodejs-postcss: Regular expression denial of service during source map parsing no…</p> https://cve.radiocsirt.org/vuln/rhsa-2021:3917