GitHub Advisoryadvisory · npm

GHSA-9m6j-fcg5-2442 Path traversal in url-parse

MEDIUM Published 2021-05-06 Modified 2026-02-03 Official page ↗
Aliases
CVE-2021-27515
Ecosystem
npm
Packages
url-parse
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-23
Reviewed
2021-03-22

Affected packages

• npm url-parse: >= 0.1.0, < 1.5.0 → fixed in 1.5.0

Description

url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

Related

Alias · CVE (1)

  • CVE-2021-27515 url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path. vulnerability

Weakness · CWE (1)

  • CWE-23 Relative Path Traversal weakness

References