https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:35:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-11619 EUVD-2026-11619 https://cve.radiocsirt.org/vuln/euvd-2026-11619 https://cve.radiocsirt.org/vuln/fkie_cve-2022-1243 <p>CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.</p> <p>CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-1243 https://cve.radiocsirt.org/vuln/ghsa-3vjf-82ff-p4r3 <p><strong>Affected:</strong> npm: urijs</p> <p>\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.</p> <p>This can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or Javascript (see following example): ```` const parse = require(&#39;urijs&#39;) const express = require(&#39;express&#39;) const app = express() const port = 3000</p> <p>input = &#34;ja\r\nvascript:alert(1)&#34; url = parse(input)</p> <p>console.log(url)</p> <p>app.get(&#39;/&#39;, (req, res) =&gt; { if (url.protocol !== &#34;javascript:&#34;) {res.send(&#34;&lt;iframe src=\&#39;&#34; + input + &#34;\&#39;&gt;CLICK ME!&lt;/iframe&gt;&#34;)} })</p> <p>app.listen(port, () =&gt; { console.log(`Example app listening on port ${port}`) }) ````</p> <p><strong>Affected:</strong> npm: urijs</p> <p>\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.</p> <p>This can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or Javascript (see following example): ```` const parse = require(&#39;urijs&#39;) const express = require(&#39;express&#39;) const app = express() const port = 3000</p> <p>input = &#34;ja\r\nvascript:alert(1)&#34; url = parse(input)</p> <p>console.log(url)</p> <p>app.get(&#39;/&#39;, (req, res) =&gt; { if (url.protocol !== &#34;javascript:&#34;) {res.send(&#34;&lt;iframe src=\&#39;&#34; + input + &#34;\&#39;&gt;CLICK ME!&lt;/iframe&gt;&#34;)} })</p> <p>app.listen(port, () =&gt; { console.log(`Example app listening on port ${port}`) }) ````</p> https://cve.radiocsirt.org/vuln/ghsa-3vjf-82ff-p4r3 https://cve.radiocsirt.org/vuln/gsd-2022-1243 gsd-2022-1243 https://cve.radiocsirt.org/vuln/gsd-2022-1243