CVE-2020-26291: 
JavaScript vulnerability analysis and mitigation

CVE-2020-26291 affects URI.js, a JavaScript URL mutation library (npm package urijs), in versions before 1.19.4. The vulnerability allows hostname spoofing through the use of backslash characters in URLs. The issue was discovered and disclosed in December 2020, affecting all versions of URI.js prior to version 1.19.4 (GitHub Advisory).

The vulnerability exists in the URL parsing functionality where the hostname can be spoofed by using a backslash () character followed by an at (@) character. For example, the URL 'https://expected-example.com\@observed-example.com' would incorrectly return 'observed-example.com' as the hostname in affected versions, while it should return 'expected-example.com'. The vulnerability has a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (NVD).

The vulnerability can lead to security decision bypasses when the hostname is used for security-related decisions. Potential impacts include allow/block list bypasses, Server-Side Request Forgery (SSRF) attacks, open redirects, or other undesired behavior depending on how the library is used and the attacker's intent (GitHub Advisory).

The vulnerability can be exploited by crafting specific URLs that use backslash characters followed by the @ symbol to manipulate the parsed hostname. The exploitation requires the ability to supply URLs to applications using the affected versions of URI.js (GitHub Advisory).

The vulnerability was patched in URI.js version 1.19.4, which correctly handles backslash characters in URLs. While version 1.19.3 included a partial fix, it remained vulnerable to certain payload variants. Users should upgrade to version 1.19.4 or later to fully mitigate the vulnerability. The patched version matches the behavior of other parsers that implement the WHATWG URL specification, including web browsers and Node's built-in URL class (GitHub Advisory, URI.js Release).