https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 01:08:10 +0000 https://cve.radiocsirt.org/vuln/certfr-2022-avi-345 certfr-2022-avi-345 https://cve.radiocsirt.org/vuln/certfr-2022-avi-345 https://cve.radiocsirt.org/vuln/cnvd-2021-62467 cnvd-2021-62467 https://cve.radiocsirt.org/vuln/cnvd-2021-62467 https://cve.radiocsirt.org/vuln/euvd-2026-21027 EUVD-2026-21027 https://cve.radiocsirt.org/vuln/euvd-2026-21027 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3647 <p>URI.js is vulnerable to URL Redirection to Untrusted Site</p> <p>URI.js is vulnerable to URL Redirection to Untrusted Site</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-3647 https://cve.radiocsirt.org/vuln/ghsa-89gv-h8wf-cg8r <p><strong>Affected:</strong> npm: urijs</p> <p>### Impact If using affected versions to determine a URL&#39;s hostname, the hostname can be spoofed by using a combination of backslash (`\`) and slash (`/`) characters as part of the scheme delimiter, e.g. `scheme:/\/\/\hostname`. If the hostname is used in security decisions, the decision may be incorrect.</p> <p>Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.</p> <p>Example URL: `https:/\/\/\expected-example.com/path` Escaped string: `https:/\\/\\/\\expected-example.com/path` (JavaScript strings must escape backslash)</p> <p>Affected versions incorrectly return no hostname. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node&#39;s built-in URL class](https://nodejs.org/api/url.html).</p> <p>### Patches Version 1.19.7 is patched against all known payload variants.</p> <p>### References https://github.com/medialize/URI.js/releases/tag/v1.19.7 (fix for this particular bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass) [PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)</p> <p>### For more information If you…</p> <p><strong>Affected:</strong> npm: urijs</p> <p>### Impact If using affected versions to determine a URL&#39;s hostname, the hostname can be spoofed by using a combination of backslash (`\`) and slash (`/`) characters as part of the scheme delimiter, e.g. `scheme:/\/\/\hostname`. If the hostname is used in security decisions, the decision may be incorrect.</p> <p>Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.</p> <p>Example URL: `https:/\/\/\expected-example.com/path` Escaped string: `https:/\\/\\/\\expected-example.com/path` (JavaScript strings must escape backslash)</p> <p>Affected versions incorrectly return no hostname. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node&#39;s built-in URL class](https://nodejs.org/api/url.html).</p> <p>### Patches Version 1.19.7 is patched against all known payload variants.</p> <p>### References https://github.com/medialize/URI.js/releases/tag/v1.19.7 (fix for this particular bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass) [PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)</p> <p>### For more information If you…</p> https://cve.radiocsirt.org/vuln/ghsa-89gv-h8wf-cg8r https://cve.radiocsirt.org/vuln/gsd-2021-3647 gsd-2021-3647 https://cve.radiocsirt.org/vuln/gsd-2021-3647 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3647 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-uri-js, Ubuntu:22.04:LTS: node-uri-js, Ubuntu:24.04:LTS: node-uri-js, Ubuntu:25.10: node-uri-js, Ubuntu:26.04:LTS: node-uri-js</p> <p>URI.js is vulnerable to URL Redirection to Untrusted Site</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-uri-js, Ubuntu:22.04:LTS: node-uri-js, Ubuntu:24.04:LTS: node-uri-js, Ubuntu:25.10: node-uri-js, Ubuntu:26.04:LTS: node-uri-js</p> <p>URI.js is vulnerable to URL Redirection to Untrusted Site</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3647