Executive brief
A vulnerability in the validator.js library, a popular tool for checking data formats in web applications, allows attackers to bypass URL security checks. By crafting a specially formatted URL, an attacker can trick the software into accepting malicious links that would normally be blocked. This can lead to users being redirected to harmful websites or the execution of malicious scripts (Cross-Site Scripting) in their browsers.
Technical details
A URL validation bypass exists in validator.js through version 13.15.15 within the isURL() function. The root cause is a parsing discrepancy: the library uses '://' as a delimiter to identify protocols, whereas web browsers and the native JavaScript URL() constructor use ':'. An attacker can exploit this by crafting URLs (e.g., using 'javascript:' without '://') that bypass protocol and domain whitelists enforced by the library. When these bypassed URLs are subsequently used in sensitive sinks like location.href, they can result in Cross-Site Scripting (XSS) or Open Redirect attacks. A patch has been merged into the repository, though users should verify the latest release version for the fix.
Affected products
- validatorjs validator.js through 13.15.15
Timeline
- 2025-09-26: other: Vulnerability details and PoC drafted by researcher
- 2025-09-30: advisory: CVE published
- 2025-10-25: patched: Patch merged into master branch