Every CVE Search/ Get API key

CVE-2022-24723

Improper Input Validation in URI.js

5.3 MediumFix available

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.94%Up 1.0 points since Mar 4, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.3

Improper Input Validation in URI.js

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Record
CVE-2022-24723
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2022-1428 5.3

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Record
EUVD-2022-1428
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-gmv4-r438-p67f 5.3

Leading white space bypasses protocol validation

Impact

Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.

Patches

Patched in 1.19.9

Workarounds

Remove leading whitespace from values before passing them to URI.parse (e.g. via .href(value) or new URI(value)), e.g. by using

function remove_whitespace(url){
     const whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
     url = url.replace(whitespace, '')
     return url
}

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-gmv4-r438-p67f
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
NVD 5.3

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Record
CVE-2022-24723
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
OSV 5.3

Improper Input Validation in URI.js

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Record
CVE-2022-24723
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-gmv4-r438-p67f 5.3

Leading white space bypasses protocol validation

Impact

Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.

Patches

Patched in 1.19.9

Workarounds

Remove leading whitespace from values before passing them to URI.parse (e.g. via .href(value) or new URI(value)), e.g. by using

function remove_whitespace(url){
     const whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
     url = url.replace(whitespace, '')
     return url
}

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-gmv4-r438-p67f
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVUBUNTU-CVE-2022-24723 5.3

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Record
UBUNTU-CVE-2022-24723
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
urijs
npm
 before 1.19.9
1.19.9
node-uri-js
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.2.2+dfsg-44.2.2+dfsg-5
 None known
node-uri-js
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.4.0+dfsg-54.4.0+dfsg-7
 None known
node-uri-js
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.4.0+dfsg-8
 None known
node-uri-js
Ubuntu:25.10
 All versions, plus listed versions
4.4.0+dfsg-8
 None known
node-uri-js
Ubuntu:26.10
 All versions, plus listed versions
4.4.0+dfsg-94.4.0+dfsg-10
 None known
node-uri-js
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.4.0+dfsg-84.4.0+dfsg-9
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24723 is a medium vulnerability (CVSS 5.3) in Medialize Uri.js, published March 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. Fixed in urijs 1.19.9.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open