CVE-2022-0868: Open Redirect in urijs
Summary
CVE-2022-0868: Open Redirect in urijs. Affects urijs versions < 1.19.10. Fixed in 1.19.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urijs is an npm package that provides a simple and lightweight URI manipulation library. It allows developers to easily parse, manipulate, and stringify URIs. However, versions prior to 1.19.10 are vulnerable to an open redirect issue. This vulnerability is a result of a bypass for the fix to CVE-2022-0613.
Vulnerability Detail
The open redirect vulnerability in urijs allows an attacker to redirect users to malicious websites by manipulating the URI. By exploiting this vulnerability, an attacker can trick users into visiting a URL that appears legitimate but actually leads to a malicious site. This can be used for phishing attacks, spreading malware, or stealing sensitive information. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Latest published version: 1.19.11 as of 23 Oct 2026
npm install urijs@1.19.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.10
This is the first release that contains the fix.
npm install urijs@1.19.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of urijs to mitigate the risk of open redirect attacks.
Conclusion
The open redirect vulnerability in urijs can lead to serious security risks, including phishing attacks and the spread of malware. It is crucial to update to the fixed version of urijs (1.19.10 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for urijs →
FAQ
An open redirect vulnerability is a security flaw that allows an attacker to redirect users from a trusted website to a malicious one. This can be used for phishing attacks or spreading malware.
By exploiting this vulnerability, an attacker can trick users into visiting a URL that appears legitimate but actually leads to a malicious site. This can result in various consequences, such as phishing attacks, spreading malware, or stealing sensitive information.
To fix this vulnerability, it is recommended to upgrade to urijs version 1.19.10 or later. This version includes a fix for the open redirect issue. Developers can update the package by running the following command: npm install urijs@1.19.10
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of urijs to mitigate the risk of open redirect attacks.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-8h2f-7jc4-7m3m.
References
Related vulnerabilities
Recent vulnerabilities recorded for urijs.
