TI-2021-08996 Aliases CVE-2021-27516 GHSA-p6j9-7xhc-rhwp

URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and…

LOW 38CWE-20Published 2021-02-21 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

Why it matters now

EPSS 0.02483 84th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed urijs (npm): 1.19.6Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	urijs (npm)	before 1.19.6	1.19.6	Patch available	GHSA-p6j9-7xhc-rhwp

— Vendor— Affected all versions Fixed in — No fix listed CNA
urijs (npm) Vendor— Affected before 1.19.6 Fixed in 1.19.6 Patch available GHSA-p6j9-7xhc-rhwp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:uri.js_project:uri.js::::::::	before 1.19.6	Vulnerable	medialize

cpe:2.3:a:uri.js_project:uri.js:*:*:*:*:*:*:*:* Versions before 1.19.6 Vulnerable ·medialize

Remediation

Fix · GHSA-p6j9-7xhc-rhwp urijs (npm) Fixed in 1.19.6 Advisory →

Red Hat 1 advisory

RHSA-2021:3917 Released 2021-10-19 · Red Hat rating Important
Red Hat Quay v3.6.0 security, bug fix and enhancement update
- Quay v3 quay/quay-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Quay v3	Fixed	RHSA-2021:3917

Not affected: 2 products

Quay v3
Red Hat Advanced Cluster Management for Kubernetes 2

Timeline

2026-10-02 Threatist record created from CVE-2021-27516
2026-10-03 Alias added: GHSA-p6j9-7xhc-rhwp

References

Exploit 1

https://advisory.checkmarx.net/advisory/CX-2021-4305

Patch 1

https://github.com/medialize/URI.js/commit/a1ad8bcbc39a4d136d7e252e76e957f3ece70839

Advisory 2

Other 2

TI-2022-08538 Improper Input Validation in URI.js CVSS 3.1MEDIUM 5.3
TI-2022-00530 Authorization Bypass Through User-Controlled Key in medialize/uri.js CVSS 3.1MEDIUM 6.5
TI-2020-16112 Hostname spoofing in URI.js CVSS 3.1MEDIUM 6.5
TI-2022-01120 URL Confusion When Scheme Not Supplied in medialize/uri.js CVSS 3.1MEDIUM 6.1
TI-2021-02592 Open Redirect in medialize/URI.js CVSS 3.1MEDIUM 6.1
TI-2022-01130 CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js CVSS 3.1MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences