CVE-2020-26291
- Source
- https://cve.org/CVERecord?id=CVE-2020-26291
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26291.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-26291
- Aliases
- Published
- 2020-12-31T00:15:12.327Z
- Modified
- 2026-07-09T01:31:06.877809Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (
\) character followed by an at (@) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URLhttps://expected-example.com\@observed-example.comwill incorrectly returnobserved-example.comif using an affected version. Patched versions correctly returnexpected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.] - References
Affected packages
Git / github.com/medialize/uri.js
Affected ranges
- Type
- GIT
- Repo
- https://github.com/medialize/uri.js
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
{ "cpe": "cpe:2.3:a:uri.js_project:uri.js:*:*:*:*:*:*:*:*", "source": [ "CPE_RANGE", "REFERENCES" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "1.19.4" } ] }