A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.

Published: 2025-09-30

CVSS: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Download Exploit for CVE-2025-56200 here:

Use Tor Browser to access .onion links.

Check our team here:

https://tatramed.sk/exploit-903-cve-2025-47287/

https://tatramed.sk/exploit-653-cve-2024-46981/

https://tatramed.sk/exploit-335-cve-2024-0769/