# CVE-2013-7452: Node.js validator XSS filter bypass via javascript URI

Source: https://junglewise.ai/threats/cve-2013-7452-node-js-validator-xss-filter-bypass-via-javascript-uri  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2013-7452 · Severity: medium · CVSS 6.1 · Published 2017-01-23

The validator library for Node.js, which is used by developers to sanitize and verify user input, contains a flaw in its cross-site scripting (XSS) filter. An attacker can bypass this security protection by using specially crafted 'javascript:' links. If successful, this could allow an attacker to execute malicious scripts in a user's browser, potentially leading to unauthorized actions or the theft of sensitive session information.

Technologies: [Nodejs Node.Js](https://junglewise.ai/threats/technologies/node-js), [validator (npm)](https://junglewise.ai/threats/technologies/npm-validator), [Validator.Js Project Validator](https://junglewise.ai/threats/technologies/validator). Vendors: [Nodejs](https://junglewise.ai/threats/vendors/nodejs), [npm](https://junglewise.ai/threats/vendors/npm), [Validator.Js Project](https://junglewise.ai/threats/vendors/validator-js-project).

## Quick answers

**Is CVE-2013-7452 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-7452 being exploited in the wild.

**How severe is CVE-2013-7452?** Medium severity, with a CVSS score of 6.1, published 23 January 2017.

**Which products and versions are affected?** validator (npm) SEMVER:introduced=0,fixed=1.1.0; Validator.Js Project Validator < 1.1.0.

**Is there a fix for CVE-2013-7452?** Yes. validator (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2013-7452 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2013-7452?** Check whether you run Nodejs Node.Js, validator (npm) or Validator.Js Project Validator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- validator (npm): upgrade to 1.1.0 or later

  ```sh
  npm install validator@1.1.0
  ```


## Technical details

A vulnerability exists in the validator library for Node.js (versions prior to 1.1.0) where the XSS filtering logic fails to properly sanitize 'javascript:' URIs. By crafting a specific URI, a remote attacker can bypass the filter to inject and execute arbitrary JavaScript in the context of the victim's browser session. This is a classic XSS filter bypass that occurs during input validation or sanitization. The issue is resolved in version 1.1.0 and later. Exploitation typically requires a user to interact with a malicious link or for the application to render the unsanitized input.

## Affected products

- Node.js validator < 1.1.0

## Identifiers

- CVE-2013-7452
- GHSA-rh6c-q938-3r9q

## Timeline

- 2013-12-12: disclosed: Original vulnerability discovery date (based on CVE year)
- 2016-04-20: advisory: Public disclosure on oss-security mailing list
- 2017-01-23: advisory: NVD publication date

## References

- [http://www.openwall.com/lists/oss-security/2016/04/20/11](http://www.openwall.com/lists/oss-security/2016/04/20/11)
- [https://nodesecurity.io/advisories/41](https://nodesecurity.io/advisories/41)

## Related threats

- [validator.js improper length calculation in isLength function](https://junglewise.ai/threats/cve-2025-12758-validator-js-improper-length-calculation-in-islength-function)
- [validatorjs validator.js URL validation bypass in isURL](https://junglewise.ai/threats/cve-2025-56200-validatorjs-validator-js-url-validation-bypass-in-isurl)
- [llhttp HTTP request smuggling via improper CRLF delimiters](https://junglewise.ai/threats/cve-2023-30589-llhttp-http-request-smuggling-via-improper-crlf-delimiters)
- [Validator.js ReDoS in trim and rtrim sanitizers](https://junglewise.ai/threats/validator-js-redos-in-trim-and-rtrim-sanitizers-3960a1b8)
- [validator.js inefficient regular expression complexity](https://junglewise.ai/threats/cve-2021-3765-validator-js-inefficient-regular-expression-complexity)