---
title: "GHSA-qpjp-7rp2-9c3f: Moderate severity vulnerability that affects validator"
description: "Moderate severity. Moderate severity vulnerability that affects validator. Affects validator; fixed in 1.1.0."
url: https://inlinr.com/advisories/GHSA-qpjp-7rp2-9c3f
lang: en
---

[Packages](https://inlinr.com/packages) / [validator](https://inlinr.com/packages/validator) / [Security](https://inlinr.com/packages/validator/security)

Moderate Vulnerability GHSA-qpjp-7rp2-9c3f CVE-2013-7451 Published 24 Oct 2017

# Moderate severity vulnerability that affects validator

Your version 

Affected releases · [validator](https://inlinr.com/packages/validator)

- 1.x 1.0.0 Fixed in 1.1.0
- 0.5.x and older 0.1.0 – 0.5.0 No fix, no longer updated

On 1.x, the newest line:

```
npm install validator@1.1.0
```

Every release on a timeline

13.x 

1. Not affected

13.0.0 – 13.15.35  
19 releases, latest

1.x 

1. Affected

1.0.0  
1 release
2. Fixed

1.1.0 – 1.5.1  
11 releases

0.x 

1. Affected

0.1.0 – 0.5.0  
57 releases

215 stable releases of validator, oldest to newest, one row per major.

## What happens

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.

## How it is exploited

Exploitable over the network, with no account and a user to do something.

- **Confidentiality**: low
- **Integrity**: low
- **Availability**: none

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:R/​S:C/​C:L/​I:L/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-7451 "https://nvd.nist.gov/vuln/detail/CVE-2013-7451")  
nvd.nist.gov/vuln/detail/CVE-2013-7451
- [GitHub advisory](https://github.com/advisories/GHSA-qpjp-7rp2-9c3f "https://github.com/advisories/GHSA-qpjp-7rp2-9c3f")  
github.com/advisories/GHSA-qpjp-7rp2-9c3f
- [Reference](http://www.openwall.com/lists/oss-security/2016/04/20/11 "http://www.openwall.com/lists/oss-security/2016/04/20/11")  
openwall.com/lists/oss-security/2016/04/20/11