📂 Vulnerable Library - class-validator-0.13.2.tgz
Decorator-based property validation for classes.
Path to dependency file: /backend/package.json
Findings
| Finding |
Severity |
🎯 CVSS |
Exploit Maturity |
EPSS |
Library |
Type |
Fixed in |
Remediation Available |
Reachability |
| CVE-2025-12758 |
🔴 High |
7.5 |
Not Defined |
< 1% |
validator-13.7.0.tgz |
Transitive |
N/A |
❌ |
 Unreachable |
| CVE-2025-56200 |
🟠 Medium |
6.1 |
Not Defined |
< 1% |
validator-13.7.0.tgz |
Transitive |
N/A |
❌ |
Unreachable |
| CVE-2019-18413 |
🟡 Low |
3.7 |
Not Defined |
< 1% |
class-validator-0.13.2.tgz |
Direct |
N/A |
❌ |
Unreachable |
Details
🔴CVE-2025-12758
Vulnerable Library - validator-13.7.0.tgz
String validation and sanitization
Library home page: https://registry.npmjs.org/validator/-/validator-13.7.0.tgz
Path to dependency file: /backend/package.json
Dependency Hierarchy:
- class-validator-0.13.2.tgz (Root Library)
- ❌ validator-13.7.0.tgz (Vulnerable Library)
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.
Publish Date: Nov 27, 2025 05:00 AM
URL: CVE-2025-12758
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 7.5
Suggested Fix
Type: Upgrade version
Origin: validatorjs/validator.js#2616
Release Date: Nov 27, 2025 05:00 AM
Fix Resolution : validator - 13.15.22,https://github.com/validatorjs/validator.js.git - 13.15.22,validator - 13.15.22
🟠CVE-2025-56200
Vulnerable Library - validator-13.7.0.tgz
String validation and sanitization
Library home page: https://registry.npmjs.org/validator/-/validator-13.7.0.tgz
Path to dependency file: /backend/package.json
Dependency Hierarchy:
- class-validator-0.13.2.tgz (Root Library)
- ❌ validator-13.7.0.tgz (Vulnerable Library)
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
Publish Date: Sep 30, 2025 12:00 AM
URL: CVE-2025-56200
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 6.1
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟡CVE-2019-18413
Vulnerable Library - class-validator-0.13.2.tgz
Decorator-based property validation for classes.
Library home page: https://registry.npmjs.org/class-validator/-/class-validator-0.13.2.tgz
Path to dependency file: /backend/package.json
Dependency Hierarchy:
- ❌ class-validator-0.13.2.tgz (Vulnerable Library)
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.
Publish Date: Oct 24, 2019 12:00 AM
URL: CVE-2019-18413
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 3.7
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
📂 Vulnerable Library - class-validator-0.13.2.tgz
Decorator-based property validation for classes.
Path to dependency file: /backend/package.json
Findings
Details
🔴CVE-2025-12758
Vulnerable Library - validator-13.7.0.tgz
String validation and sanitization
Library home page: https://registry.npmjs.org/validator/-/validator-13.7.0.tgz
Path to dependency file: /backend/package.json
Dependency Hierarchy:
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.
Publish Date: Nov 27, 2025 05:00 AM
URL: CVE-2025-12758
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 7.5
Suggested Fix
Type: Upgrade version
Origin: validatorjs/validator.js#2616
Release Date: Nov 27, 2025 05:00 AM
Fix Resolution : validator - 13.15.22,https://github.com/validatorjs/validator.js.git - 13.15.22,validator - 13.15.22
🟠CVE-2025-56200
Vulnerable Library - validator-13.7.0.tgz
String validation and sanitization
Library home page: https://registry.npmjs.org/validator/-/validator-13.7.0.tgz
Path to dependency file: /backend/package.json
Dependency Hierarchy:
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
Publish Date: Sep 30, 2025 12:00 AM
URL: CVE-2025-56200
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 6.1
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟡CVE-2019-18413
Vulnerable Library - class-validator-0.13.2.tgz
Decorator-based property validation for classes.
Library home page: https://registry.npmjs.org/class-validator/-/class-validator-0.13.2.tgz
Path to dependency file: /backend/package.json
Dependency Hierarchy:
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.
Publish Date: Oct 24, 2019 12:00 AM
URL: CVE-2019-18413
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 3.7
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :