Vulnerability · Published Mar 3, 2022 · Assigned by GitHub_M

CVE-2022-24723Improper Input Validation in URI.js

Medium 5.3

In plain English

A medium-severity improper input validation in URI.js from medialize. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.9%top 19.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	node-uri-js	no fix listed	UBUNTU-CVE-2022-24723
Ubuntu:24.04:LTS	node-uri-js	no fix listed	UBUNTU-CVE-2022-24723
Ubuntu:25.10	node-uri-js	no fix listed	UBUNTU-CVE-2022-24723
Ubuntu:26.04:LTS	node-uri-js	no fix listed	UBUNTU-CVE-2022-24723
Ubuntu:26.10	node-uri-js	no fix listed	UBUNTU-CVE-2022-24723
npm	urijs	1.19.9	GHSA-gmv4-r438-p67f

Affected products (as reported)

Vendor	Product	Versions
medialize	URI.js	< 1.19.9

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/medialize/URI.js/security/advisories/GHSA-gmv4-r438-p67f x_refsource_CONFIRM
https://github.com/medialize/uri.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316 x_refsource_MISC
https://github.com/medialize/URI.js/releases/tag/v1.19.9 x_refsource_MISC
https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/ x_refsource_MISC