TI-2022-08538 Aliases CVE-2022-24723 GHSA-gmv4-r438-p67f

Improper Input Validation in URI.js

MEDIUM 63CWE-20Published 2022-03-03 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01941 80th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial URI.js (medialize): 1.19.9urijs (npm): 1.19.9Red Hat: 2 advisoriesRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
medialize	URI.js	before 1.19.9	1.19.9	Patch available	CNA
—	urijs (npm)	before 1.19.9	1.19.9	Patch available	GHSA-gmv4-r438-p67f

URI.js Vendormedialize Affected before 1.19.9 Fixed in 1.19.9 Patch available CNA
urijs (npm) Vendor— Affected before 1.19.9 Fixed in 1.19.9 Patch available GHSA-gmv4-r438-p67f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:uri.js_project:uri.js::::::::	before 1.19.9	Vulnerable	medialize

cpe:2.3:a:uri.js_project:uri.js:*:*:*:*:*:*:*:* Versions before 1.19.9 Vulnerable ·medialize

Remediation

Fix · CNA URI.js (medialize) Fixed in 1.19.9
Fix · GHSA-gmv4-r438-p67f urijs (npm) Fixed in 1.19.9 Advisory →

Red Hat 2 advisories

RHSA-2022:8652 Released 2022-11-28 · Red Hat rating Important
Red Hat Fuse 7.11.1 release and security update
- Red Hat Fuse 7.11.1
RHSA-2022:1681 Released 2022-05-03 · Red Hat rating Moderate
Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
.NET Core 3.1 on Red Hat Enterprise Linux	Affected	No fix yet
.NET Core 5.0 on Red Hat Enterprise Linux	Affected	No fix planned: Out of support scope
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet
Red Hat Enterprise Linux 8	Affected	No fix planned: Will not fix
Red Hat Quay 3	Affected	No fix planned: Will not fix
Red Hat Fuse 7.11.1	Fixed	RHSA-2022:8652

Timeline

2026-10-02 Threatist record created from CVE-2022-24723
2026-10-03 Alias added: GHSA-gmv4-r438-p67f

References

Exploit 1

https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/

Patch 1

https://github.com/medialize/uri.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316

Advisory 3

Other 3

TI-2021-08996 URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and… CVSS 3.1HIGH 7.5
TI-2022-00530 Authorization Bypass Through User-Controlled Key in medialize/uri.js CVSS 3.1MEDIUM 6.5
TI-2020-16112 Hostname spoofing in URI.js CVSS 3.1MEDIUM 6.5
TI-2022-01120 URL Confusion When Scheme Not Supplied in medialize/uri.js CVSS 3.1MEDIUM 6.1
TI-2021-02592 Open Redirect in medialize/URI.js CVSS 3.1MEDIUM 6.1
TI-2022-01130 CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js CVSS 3.1MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences