Leading white space bypasses protocol validation
Impact
Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.
Patches
Patched in 1.19.9
Workarounds
Remove leading whitespace from values before passing them to URI.parse (e.g. via .href(value) or new URI(value)), e.g. by using
function remove_whitespace(url){
const whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
url = url.replace(whitespace, '')
return url
}References
For more information
If you have any questions or comments about this advisory:
- Open an issue in medialize/URI.js
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | urijs | < 1.19.9 | 1.19.9 |
References
- https://github.com/medialize/URI.js/security/advisories/GHSA-gmv4-r438-p67f
- https://nvd.nist.gov/vuln/detail/CVE-2022-24723
- https://github.com/medialize/URI.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316
- https://github.com/medialize/URI.js
- https://github.com/medialize/URI.js/releases/tag/v1.19.9
- https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-20- Platform
- npm
- Package
urijs- Disclosed
- 03.03.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-gmv4-r438-p67f - CC BY 4.0
Vulnerability history: urijs
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 12.2020 04.2022
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 6
Disclosures per year
- 2020: 1
- 2021: 2
- 2022: 5
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Leading white space bypasses protocol validation this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.