npm package report

Is urijs safe?

urijs (npm) has 8 known vulnerabilities, the worst rated HIGH. Upgrade to 1.19.11 or later to clear all of them. No malicious-package signal is recorded.

// reach

0 direct dependencies

none carry a known advisory

    1 packages depend on it

    an advisory here reaches each of them

    Create a free accountfor every dependency path, dependent and what to upgrade
    // ai model usage

    Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

    cvss
    7.2
    high

    CVSS v3.0 base score out of 10

    epss
    0.67%
    medium

    chance of exploitation in 30 days, 53rd percentile of all CVEs

    xyz score
    4.1
    medium

    CyberXYZ composite out of 10

    fig. 01 — GHSA-3vjf-82ff-p4r3, the advisory selected below

    // 8 advisories

    \r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.

    Full advisory text at GitHub advisory or NVD.

    // cvss v3.0 vector

    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

    Attack vector
    Network
    Attack complexity
    Low
    Privileges required
    None
    User interaction
    None
    Scope
    Changed
    Confidentiality
    Low
    Integrity
    Low
    Availability
    None
    // questions
    Is urijs safe to install?

    CyberXYZ does not call a package safe in absolute terms. It records 8 known vulnerabilities for urijs (npm), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.

    Does urijs have known vulnerabilities?

    Yes. CyberXYZ records 8 known vulnerabilities for urijs (npm), the worst rated HIGH. These include GHSA-3vjf-82ff-p4r3, GHSA-p6j9-7xhc-rhwp, GHSA-g694-m8vq-gv9h, GHSA-8h2f-7jc4-7m3m, GHSA-gmv4-r438-p67f.

    Which version of urijs should I use?

    1.19.11 or later clears every advisory recorded for urijs (npm). Check the release you pick before installing it.

    How do I check urijs before installing?

    Search urijs in CyberXYZ Check at https://cyberxyz.io/check?q=urijs. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.

    Checked 2026-11-14 at 10:30 UTC. The most recent advisory here was published 2022-04-06. Updated continuously from NVD, GHSA, OSV and CNA feeds.

    Think a verdict here is wrong? Tell us — we respond within 2 business days.