CVE-2022-24723

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
medialize	URI.js	< 1.19.9

References

https://github.com/medialize/URI.js/releases/tag/v1.19.9Release Notes, Third Party Advisory
https://github.com/medialize/URI.js/security/advisories/GHSA-gmv4-r438-p67fMitigation, Third Party Advisory
https://github.com/medialize/uri.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316Patch, Third Party Advisory
https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/medialize/URI.js/releases/tag/v1.19.9Release Notes, Third Party Advisory
https://github.com/medialize/URI.js/security/advisories/GHSA-gmv4-r438-p67fMitigation, Third Party Advisory
https://github.com/medialize/uri.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316Patch, Third Party Advisory
https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Mar 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247249.8cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an CVE-2022-247255.5Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix sys CVE-2022-247267.5Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable CVE-2022-247285.4CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module CVE-2022-247297.5CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dia CVE-2022-24734.8The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in ver CVE-2022-247306.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.CVE-2022-247314.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.CVE-2022-247328.8Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or accou CVE-2022-247336.1Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attac CVE-2022-247347.2MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting type CVE-2022-247357.8Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with acc