# CVE-2013-7454: Node.js validator XSS filter bypass via nested forbidden strings

Source: https://junglewise.ai/threats/cve-2013-7454-node-js-validator-xss-filter-bypass-via-nested-forbidden-strings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2013-7454 · Severity: medium · CVSS 6.1 · Published 2017-01-23

The validator library for Node.js, which is used by developers to sanitize and validate user input, contains a flaw in its Cross-Site Scripting (XSS) filter. An attacker can bypass security protections by using specially crafted nested strings that the filter fails to remove. This could allow an attacker to execute malicious scripts in a user's browser, potentially leading to unauthorized actions or data theft.

Technologies: [Nodejs Node.Js](https://junglewise.ai/threats/technologies/node-js), [validator (npm)](https://junglewise.ai/threats/technologies/npm-validator), [Validator.Js Project Validator](https://junglewise.ai/threats/technologies/validator). Vendors: [Nodejs](https://junglewise.ai/threats/vendors/nodejs), [npm](https://junglewise.ai/threats/vendors/npm), [Validator.Js Project](https://junglewise.ai/threats/vendors/validator-js-project).

## Quick answers

**Is CVE-2013-7454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-7454 being exploited in the wild.

**How severe is CVE-2013-7454?** Medium severity, with a CVSS score of 6.1, published 23 January 2017.

**Which products and versions are affected?** validator (npm) SEMVER:introduced=0,fixed=1.1.0; Validator.Js Project Validator < 1.1.0.

**Is there a fix for CVE-2013-7454?** Yes. validator (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2013-7454 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2013-7454?** Check whether you run Nodejs Node.Js, validator (npm) or Validator.Js Project Validator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- validator (npm): upgrade to 1.1.0 or later

  ```sh
  npm install validator@1.1.0
  ```


## Technical details

The validator library for Node.js (versions prior to 1.1.0) is vulnerable to a Cross-Site Scripting (XSS) filter bypass. The vulnerability exists because the sanitization logic fails to recursively or effectively handle nested forbidden strings. A remote attacker can exploit this by submitting input containing nested tags or forbidden keywords that, when processed once, leave behind executable malicious code. This is a network-based attack that typically requires user interaction (UI:R) to execute the resulting script in the victim's browser context. The issue was addressed in version 1.1.0.

## Affected products

- Node.js validator < 1.1.0

## Identifiers

- CVE-2013-7454
- GHSA-q4qq-fm7q-cwp5

## Timeline

- 2013-12-12: disclosed: Vulnerability identified (based on CVE year)
- 2017-01-23: advisory: NVD published the CVE details

## References

- [http://www.openwall.com/lists/oss-security/2016/04/20/11](http://www.openwall.com/lists/oss-security/2016/04/20/11)
- [https://nodesecurity.io/advisories/41](https://nodesecurity.io/advisories/41)

## Related threats

- [validator.js improper length calculation in isLength function](https://junglewise.ai/threats/cve-2025-12758-validator-js-improper-length-calculation-in-islength-function)
- [validatorjs validator.js URL validation bypass in isURL](https://junglewise.ai/threats/cve-2025-56200-validatorjs-validator-js-url-validation-bypass-in-isurl)
- [llhttp HTTP request smuggling via improper CRLF delimiters](https://junglewise.ai/threats/cve-2023-30589-llhttp-http-request-smuggling-via-improper-crlf-delimiters)
- [Validator.js ReDoS in trim and rtrim sanitizers](https://junglewise.ai/threats/validator-js-redos-in-trim-and-rtrim-sanitizers-3960a1b8)
- [validator.js inefficient regular expression complexity](https://junglewise.ai/threats/cve-2021-3765-validator-js-inefficient-regular-expression-complexity)