-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how parseUrl handles git-style URLs. The commit adds special handling for 'file' protocol URLs with a regex that extracts pathname components. Before the patch, this pathname value (derived directly from user input) wasn't properly sanitized when returned in parsed URL components. If applications using this library rendered these parsed values without HTML escaping (e.g., displaying resource/pathname in UI), stored XSS could occur. The patch introduces protocol normalization but shows evidence of pathname manipulation that was previously vulnerable.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-url | npm | < 6.0.1 | 6.0.1 |
Ongoing coverage of React2Shell