Quick answers
- Is CVE-2022-2218 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-2218 being exploited in the wild.
- How severe is CVE-2022-2218?
- Low severity, with a CVSS score of 3.1, published 28 June 2022.
- Which products and versions are affected?
- parse-url (npm) SEMVER:introduced=0,fixed=6.0.1.
- Is there a fix for CVE-2022-2218?
- Yes. parse-url (npm): upgrade to 6.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-2218 attacked?
- It is attacked over the network.
- Am I affected by CVE-2022-2218?
- Check whether you run parse-url (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- parse-url (npm): upgrade to 6.0.1 or later
npm install parse-url@6.0.1
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw (CWE-79) in parse-url prior to version 6.0.1. The library failed to properly sanitize or validate user-supplied input when parsing URLs, allowing malicious scripts to be embedded in parsed output. An attacker could craft a malicious URL that, when parsed by the library, would output unsanitized JavaScript code. Applications using parse-url to display user-controlled URLs or to process untrusted URL input are vulnerable. The fix was applied in version 6.0.1, released on 2022-06-27.
Affected products
- Ionica Bizau parse-url prior to 6.0.1
Identifiers
- CVE-2022-2218
- GHSA-jpp7-7chh-cf67
Timeline
- 2022-06-28: disclosed: Published to GitHub Advisory Database
- 2022-06-27: patched: Fix released in version 6.0.1