[GHSA-9965-vmph-33xx] validator.js has a URL validation bypass vulnerability in its isURL function

[G-Rath]

Updates

• Affected products
• Description
• References

Comments
Updated patch version

[Copilot]

Pull Request Overview

This PR adds a new security advisory for validator.js documenting a URL validation bypass vulnerability (CVE-2025-56200) that affects versions prior to 13.15.15. The vulnerability allows attackers to bypass protocol and domain validation due to parsing differences between the isURL() function and browsers, potentially leading to XSS and Open Redirect attacks.

• Documents CVE-2025-56200 affecting validator.js versions before 13.15.15
• Includes vulnerability details, CVSS score (MODERATE severity), and references to issues, PRs, and gists
• Specifies CWE-79 (XSS) as the weakness type

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[G-Rath]

ek nope I have that mixed up - new version should hopefully be released in the next day or so, but not yet out 😅