CVE-2014-9772
XSS Filter Bypass via Encoded URL in validator
The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.
- Record
CVE-2014-9772- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.
- Record
CVE-2014-9772- Updated
- 2026-11-02
EUVDEUVD-2018-0733 No score
The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.
- Record
EUVD-2018-0733- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-79mx-88w7-8f7q
XSS Filter Bypass via Encoded URL in validator
Versions of validator prior to 2.0.0 contained an xss filter method that is affected by several filter bypasses. This may result in a cross-site scripting vulnerability.
Proof of Concept
The xss() function removes the word "javascript" when contained inside an attribute.
However, it does not properly handle cases where characters have been hex-encoded.
As a result, it is possible to build an input that bypasses the filter but which the browser will accept as valid JavaScript.
For example:
<a href="javascript:...">abc</a>
will render as:
<a href="javascript:...">abc</a>
Recommendation
The package author has decided to remove the xss filter functionality in the latest version of this module. If this feature is not currently being used, you are not affected by the vulnerability. If it is being used, updating to the latest version of the module will break your application.
In order for affected users to mitigate this vulnerability, it is necessary to use an alternative package that provides similar functionality.
- Record
GHSA-79mx-88w7-8f7q- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-79mx-88w7-8f7q
XSS Filter Bypass via Encoded URL in validator
Versions of validator prior to 2.0.0 contained an xss filter method that is affected by several filter bypasses. This may result in a cross-site scripting vulnerability.
Proof of Concept
The xss() function removes the word "javascript" when contained inside an attribute.
However, it does not properly handle cases where characters have been hex-encoded.
As a result, it is possible to build an input that bypasses the filter but which the browser will accept as valid JavaScript.
For example:
<a href="javascript:...">abc</a>
will render as:
<a href="javascript:...">abc</a>
Recommendation
The package author has decided to remove the xss filter functionality in the latest version of this module. If this feature is not currently being used, you are not affected by the vulnerability. If it is being used, updating to the latest version of the module will break your application.
In order for affected users to mitigate this vulnerability, it is necessary to use an alternative package that provides similar functionality.
- Record
GHSA-79mx-88w7-8f7q- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9772
The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.
- Record
UBUNTU-CVE-2014-9772- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
validatornpm |
before 2.0.0 | 2.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9772 is a medium vulnerability (CVSS 6.1) in Nodejs Node.js, published January 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in validator 2.0.0.