{"id":"CVE-2025-56200","aliases":["CLSA-2026-1777163882","CLSA-2026-1784769499","CLSA-2026-1788519023","CLSA-2026-1789161501","CLSA-2026-1789161525","EUVD-2025-31764","GHSA-9965-vmph-33xx","ROOT-APP-NPM-CVE-2025-56200","UBUNTU-CVE-2025-56200"],"status":"published","title":"validator.js has a URL validation bypass vulnerability in its isURL function","description":"A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00324,"percentile":0.25722,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-09-30T00:00:00Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"npm","package":"validator","fixed_in":["13.15.20"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"validator","fixed_in":["8.2.0-tuxcare.3","4.4.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/validator","fixed_in":["13.12.0-root.io.3","13.15.15-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"validator","fixed_in":["13.12.0-aikido.3","13.15.15-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.15.20"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.11.0-tuxcare.0"},{"fixed":"10.11.0-tuxcare.3"}]}],"versions":["10.11.0","10.11.0-tuxcare.1","10.11.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0-tuxcare.0"},{"fixed":"8.2.0-tuxcare.3"}]}],"versions":["8.2.0","8.2.0-tuxcare.1","8.2.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.12.0-tuxcare.0"},{"fixed":"13.12.0-tuxcare.1"}]}],"versions":["13.12.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-tuxcare.0"},{"fixed":"4.4.0-tuxcare.1"}]}],"versions":["4.4.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0-tuxcare.0"},{"fixed":"7.2.0-tuxcare.1"}]}],"versions":["7.2.0"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"validator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"13.15.20"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.12.0-root.io.3"},{"fixed":"13.15.15-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.12.0-aikido.3"},{"fixed":"13.15.15-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"validator.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.17.0+dfsg1-1","4.7.1+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"validator.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.1+dfsg1-1.1"]}],"products":[{"vendor":"validator_project","product":"validator"}],"references":[{"url":"https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://github.com/validatorjs/validator.js","tags":["Product","package"]},{"url":"https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-56200","tags":["advisory"]},{"url":"http://validatorjs.com","tags":["web"]},{"url":"https://github.com/validatorjs/validator.js/issues/2600","tags":["web"]},{"url":"https://github.com/validatorjs/validator.js/pull/2608","tags":["web"]},{"url":"https://github.com/validatorjs/validator.js/commit/cbef5088f02d36caf978f378bb845fe49bdc0809","tags":["web"]},{"url":"https://github.com/validatorjs/validator.js/releases/tag/13.15.20","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9965-vmph-33xx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/56xxx/CVE-2025-56200.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-56200","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-56200","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-56200","description":"A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","status":"published","published":"2025-09-30T00:00:00Z","modified":"2026-07-05T01:11:56.797Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:26.320248Z"}],"euvd":[{"id":"EUVD-2025-31764","description":"A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","status":"published","published":"2025-09-30T00:00:00Z","modified":"2026-07-05T01:11:56Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:15.276406Z"}],"ghsa":[{"id":"GHSA-9965-vmph-33xx","title":"validator.js has a URL validation bypass vulnerability in its isURL function","description":"A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","status":"published","published":"2025-09-30T18:30:25Z","modified":"2025-10-27T12:53:01Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:03.380616Z"}],"nvd":[{"id":"CVE-2025-56200","description":"A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","status":"published","published":"2025-09-30T18:15:50.307Z","modified":"2026-07-05T02:16:58.16Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:34.090044Z"}],"osv":[{"id":"CVE-2025-56200","description":"A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","status":"published","published":"2025-09-30T00:00:00Z","modified":"2026-10-28T02:30:50.430423865Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"GHSA-9965-vmph-33xx","title":"validator.js has a URL validation bypass vulnerability in its isURL function","description":"A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","status":"published","published":"2025-09-30T18:30:25Z","modified":"2026-09-10T03:50:28.187015105Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"UBUNTU-CVE-2025-56200","description":"A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","status":"published","published":"2025-09-30T18:15:00Z","modified":"2025-10-24T05:23:36Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"CLSA-2026-1777163882","title":"TuxCare security update for validator (2 CVEs)","description":"TuxCare rebuilt validator to address 2 CVEs. Fixed in 10.11.0-tuxcare.3.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:45:48.669728574Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1784769499","title":"TuxCare security update for validator (1 CVE)","description":"TuxCare rebuilt validator to address 1 CVE. Fixed in 8.2.0-tuxcare.3.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.283530815Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1788519023","title":"TuxCare security update for validator (2 CVEs)","description":"TuxCare rebuilt validator to address 2 CVEs. Fixed in 13.12.0-tuxcare.1.","status":"published","published":"2026-09-04T10:50:23Z","modified":"2026-10-15T09:48:03.100828069Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789161501","title":"TuxCare security update for validator (1 CVE)","description":"TuxCare rebuilt validator to address 1 CVE. Fixed in 4.4.0-tuxcare.1.","status":"published","published":"2026-09-11T21:18:21Z","modified":"2026-10-15T09:48:04.019351963Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789161525","title":"TuxCare security update for validator (2 CVEs)","description":"TuxCare rebuilt validator to address 2 CVEs. Fixed in 7.2.0-tuxcare.1.","status":"published","published":"2026-09-11T21:18:45Z","modified":"2026-10-15T09:48:03.871977294Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"ROOT-APP-NPM-CVE-2025-56200","title":"CVE-2025-56200 in @rootio/validator - Patched by Root","description":"Root has patched CVE-2025-56200 in the @rootio/validator package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-14T13:09:41Z","modified":"2026-07-14T19:17:01.767645142Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}