Is CVE-2025-56200 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-56200 being exploited in the wild.

How severe is CVE-2025-56200?

Medium severity, with a CVSS score of 6.1, published 30 September 2025.

Which products and versions are affected?

validator (npm) SEMVER:introduced=0,fixed=13.15.20.

Is there a fix for CVE-2025-56200?

Yes. validator (npm): upgrade to 13.15.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-56200 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-56200?

Check whether you run validator (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-56200: validatorjs validator.js URL validation bypass in isURL

CVE-2025-56200 · Severity: medium · CVSS 6.1 · Published 2025-09-30

A vulnerability in the validator.js library, a popular tool for checking data formats in web applications, allows attackers to bypass URL security checks. By crafting a specially formatted URL, an attacker can trick the software into accepting malicious links that would normally be blocked. This can lead to users being redirected to harmful websites or the execution of malicious scripts (Cross-Site Scripting) in their browsers.

Technologies: validator (npm). Vendors: npm.

Quick answers

Is CVE-2025-56200 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-56200 being exploited in the wild.
How severe is CVE-2025-56200?: Medium severity, with a CVSS score of 6.1, published 30 September 2025.
Which products and versions are affected?: validator (npm) SEMVER:introduced=0,fixed=13.15.20.
Is there a fix for CVE-2025-56200?: Yes. validator (npm): upgrade to 13.15.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-56200 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-56200?: Check whether you run validator (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

validator (npm): upgrade to 13.15.20 or later
```
npm install validator@13.15.20
```

Technical details

A URL validation bypass exists in validator.js through version 13.15.15 within the isURL() function. The root cause is a parsing discrepancy: the library uses '://' as a delimiter to identify protocols, whereas web browsers and the native JavaScript URL() constructor use ':'. An attacker can exploit this by crafting URLs (e.g., using 'javascript:' without '://') that bypass protocol and domain whitelists enforced by the library. When these bypassed URLs are subsequently used in sensitive sinks like location.href, they can result in Cross-Site Scripting (XSS) or Open Redirect attacks. A patch has been merged into the repository, though users should verify the latest release version for the fix.

Affected products

validatorjs validator.js through 13.15.15

Identifiers

CVE-2025-56200
GHSA-9965-vmph-33xx

Timeline

2025-09-26: other: Vulnerability details and PoC drafted by researcher
2025-09-30: advisory: CVE published
2025-10-25: patched: Patch merged into master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.