CVE-2025-56200
validator.js has a URL validation bypass vulnerability in its isURL function
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
- Record
CVE-2025-56200- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-31764
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
- Record
EUVD-2025-31764- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9965-vmph-33xx
validator.js has a URL validation bypass vulnerability in its isURL function
A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
- Record
GHSA-9965-vmph-33xx- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
- Record
CVE-2025-56200- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
- Record
CVE-2025-56200- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-9965-vmph-33xx
validator.js has a URL validation bypass vulnerability in its isURL function
A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
- Record
GHSA-9965-vmph-33xx- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2025-56200
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
- Record
UBUNTU-CVE-2025-56200- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1777163882 No score
TuxCare security update for validator (2 CVEs)
TuxCare rebuilt validator to address 2 CVEs. Fixed in 10.11.0-tuxcare.3.
- Record
CLSA-2026-1777163882- Updated
- 2026-11-02
OSVCLSA-2026-1784769499 No score
TuxCare security update for validator (1 CVE)
TuxCare rebuilt validator to address 1 CVE. Fixed in 8.2.0-tuxcare.3.
- Record
CLSA-2026-1784769499- Updated
- 2026-11-02
OSVCLSA-2026-1788519023 No score
TuxCare security update for validator (2 CVEs)
TuxCare rebuilt validator to address 2 CVEs. Fixed in 13.12.0-tuxcare.1.
- Record
CLSA-2026-1788519023- Updated
- 2026-11-02
OSVCLSA-2026-1789161501 No score
TuxCare security update for validator (1 CVE)
TuxCare rebuilt validator to address 1 CVE. Fixed in 4.4.0-tuxcare.1.
- Record
CLSA-2026-1789161501- Updated
- 2026-11-02
OSVCLSA-2026-1789161525 No score
TuxCare security update for validator (2 CVEs)
TuxCare rebuilt validator to address 2 CVEs. Fixed in 7.2.0-tuxcare.1.
- Record
CLSA-2026-1789161525- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-56200 No score
CVE-2025-56200 in @rootio/validator - Patched by Root
Root has patched CVE-2025-56200 in the @rootio/validator package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-56200- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
validatornpm |
before 13.15.20 | 13.15.20 |
validatorTuxCare:npm From an advisory covering 2 CVEs |
10.11.0-tuxcare.0 up to 10.11.0-tuxcare.3, plus listed versions 10.11.010.11.0-tuxcare.110.11.0-tuxcare.2 |
10.11.0-tuxcare.3 |
validatorTuxCare:npm |
8.2.0-tuxcare.0 up to 8.2.0-tuxcare.3, plus listed versions 8.2.08.2.0-tuxcare.18.2.0-tuxcare.2 |
8.2.0-tuxcare.3 |
validatorTuxCare:npm From an advisory covering 2 CVEs |
13.12.0-tuxcare.0 up to 13.12.0-tuxcare.1, plus listed versions 13.12.0 |
13.12.0-tuxcare.1 |
validatorTuxCare:npm |
4.4.0-tuxcare.0 up to 4.4.0-tuxcare.1, plus listed versions 4.4.0 |
4.4.0-tuxcare.1 |
validatorTuxCare:npm From an advisory covering 2 CVEs |
7.2.0-tuxcare.0 up to 7.2.0-tuxcare.1, plus listed versions 7.2.0 |
7.2.0-tuxcare.1 |
@rootio/validatorRoot:npm |
before 13.12.0-root.io.3 | 13.12.0-root.io.313.15.15-root.io.1 |
validatorRoot:npm |
before 13.12.0-aikido.3 | 13.12.0-aikido.313.15.15-aikido.1 |
validator.jsUbuntu:16.04:LTS |
All versions, plus listed versions 3.17.0+dfsg1-14.7.1+dfsg1-1 |
None known |
validator.jsUbuntu:18.04:LTS |
All versions, plus listed versions 4.7.1+dfsg1-1.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-56200 is a medium vulnerability (CVSS 6.1) in Validator Project Validator, published September 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in validator 13.15.20.
References
gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596
github.com/validatorjs/validator.js
nvd.nist.gov/vuln/detail/CVE-2025-56200
validatorjs.com
Show 7 moreShow less
ubuntu.com/security/CVE-2025-56200
cve.org/CVERecord?id=CVE-2025-56200