Description
URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Remediation
References
https://advisory.checkmarx.net/advisory/CX-2021-4305
https://github.com/medialize/URI.js/commit/a1ad8bcbc39a4d136d7e252e76e957f3ece70839
https://github.com/medialize/URI.js/releases/tag/v1.19.6
Related Vulnerabilities
CVE-2023-26134 Vulnerability in npm package git-commit-info
CVE-2021-23364 Vulnerability in npm package browserslist
CVE-2021-33611 Vulnerability in maven package org.webjars.bowergithub.vaadin:vaadin-menu-bar
CVE-2023-25827 Vulnerability in maven package net.opentsdb:opentsdb
CVE-2023-29527 Vulnerability in maven package org.xwiki.platform:xwiki-platform-appwithinminutes-ui