-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe XSS vulnerability stems from improper handling of URL parsing in git-ssh formats. The commit 21c72ab introduced a regex (GIT_RE) to better handle these cases, indicating the previous implementation lacked proper validation. The parseUrl function directly processes user-controlled URLs and returns parsed components (pathname, resource, etc.) that could contain untrusted input. When these components are used in web output without proper encoding, XSS occurs. The function's role as the primary URL parser and the security-focused patch targeting its git-ssh handling make it the clear vulnerability source.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-url | npm | < 6.0.1 | 6.0.1 |