org.webjars.npm:uri-js 4.2.1

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:uri-js package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Uncaught Exception Affected versions of this package are vulnerable to Uncaught Exception in the `parse()` function of `src/schemes/mailto.ts`, whose `to` branch calls `hfield[1].split(",")` directly, while the `subject`, `body`, and default branches all route through `unescapeComponent()`, which short-circuits on a missing value. An attacker can crash the process by supplying a mailto URI whose query carries a bare `to` token with no `=value`, such as `mailto:?to`, so splitting on `=` yields a one element array and the undefined second element is dereferenced. This requires the application to pass an attacker-influenced string to `URI.parse()`, `URI.resolve()`, `URI.normalize()`, or `URI.equal()`, none of which wrap the scheme handler in a `try`/`catch`, and whether the throw terminates the process or only fails the one request depends on the host's own error handling. How to fix Uncaught Exception? There is no fixed version for `org.webjars.npm:uri-js`.	[0,)
M Improper Encoding or Escaping of Output Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via `pctDecChars()`, which decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. An attacker can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering. How to fix Improper Encoding or Escaping of Output? There is no fixed version for `org.webjars.npm:uri-js`.	[0,)

Vulnerability

Vulnerable Version

Uncaught Exception

Affected versions of this package are vulnerable to Uncaught Exception in the parse() function of src/schemes/mailto.ts, whose to branch calls hfield[1].split(",") directly, while the subject, body, and default branches all route through unescapeComponent(), which short-circuits on a missing value. An attacker can crash the process by supplying a mailto URI whose query carries a bare to token with no =value, such as mailto:?to, so splitting on = yields a one element array and the undefined second element is dereferenced. This requires the application to pass an attacker-influenced string to URI.parse(), URI.resolve(), URI.normalize(), or URI.equal(), none of which wrap the scheme handler in a try/catch, and whether the throw terminates the process or only fails the one request depends on the host's own error handling.

How to fix Uncaught Exception?

There is no fixed version for org.webjars.npm:uri-js.

[0,)

Improper Encoding or Escaping of Output

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars(), which decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. An attacker can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.

How to fix Improper Encoding or Escaping of Output?

There is no fixed version for org.webjars.npm:uri-js.

[0,)

org.webjars.npm:uri-js@4.2.1

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically