Description
URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Remediation
References
https://github.com/medialize/URI.js/commit/a1ad8bcbc39a4d136d7e252e76e957f3ece70839
https://github.com/medialize/URI.js/releases/tag/v1.19.6
https://advisory.checkmarx.net/advisory/CX-2021-4305
Related Vulnerabilities
CVE-2020-6429 Vulnerability in maven package org.webjars.npm:electron
CVE-2017-12647 Vulnerability in maven package com.liferay:com.liferay.knowledge.base.service
CVE-2021-22060 Vulnerability in maven package org.springframework:spring-core
CVE-2020-15366 Vulnerability in maven package org.webjars.bower:ajv
CVE-2020-6831 Vulnerability in maven package org.webjars.npm:electron