class-validator-0.13.2.tgz: 3 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - class-validator-0.13.2.tgz

Decorator-based property validation for classes.

Library home page: https://registry.npmjs.org/class-validator/-/class-validator-0.13.2.tgz

Found in HEAD commit: a9ca696e4063e48a10f252dd7479d512df1895ad

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (class-validator version)	Remediation Possible**
CVE-2025-12758	High	7.5	validator-13.7.0.tgz	Transitive	0.14.0	❌
CVE-2025-56200	Medium	6.1	validator-13.7.0.tgz	Transitive	N/A*	❌
CVE-2019-18413	Low	3.7	class-validator-0.13.2.tgz	Direct	class-validator - 0.14.0	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-12758

Vulnerable Library - validator-13.7.0.tgz

String validation and sanitization

Library home page: https://registry.npmjs.org/validator/-/validator-13.7.0.tgz

Dependency Hierarchy:

• class-validator-0.13.2.tgz (Root Library)
  • ❌ validator-13.7.0.tgz (Vulnerable Library)

Found in HEAD commit: a9ca696e4063e48a10f252dd7479d512df1895ad

Found in base branch: develop

Vulnerability Details

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

Publish Date: 2025-11-27

URL: CVE-2025-12758

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-11-27

Fix Resolution (validator): 13.15.22

Direct dependency fix Resolution (class-validator): 0.14.0

CVE-2025-56200

Vulnerable Library - validator-13.7.0.tgz

String validation and sanitization

Library home page: https://registry.npmjs.org/validator/-/validator-13.7.0.tgz

Dependency Hierarchy:

• class-validator-0.13.2.tgz (Root Library)
  • ❌ validator-13.7.0.tgz (Vulnerable Library)

Found in HEAD commit: a9ca696e4063e48a10f252dd7479d512df1895ad

Found in base branch: develop

Vulnerability Details

A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.

Publish Date: 2025-09-30

URL: CVE-2025-56200

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9965-vmph-33xx

Release Date: 2025-09-30

Fix Resolution: validator - 13.15.20

CVE-2019-18413

Vulnerable Library - class-validator-0.13.2.tgz

Decorator-based property validation for classes.

Library home page: https://registry.npmjs.org/class-validator/-/class-validator-0.13.2.tgz

Dependency Hierarchy:

• ❌ class-validator-0.13.2.tgz (Vulnerable Library)

Found in HEAD commit: a9ca696e4063e48a10f252dd7479d512df1895ad

Found in base branch: develop

Vulnerability Details

In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.

Publish Date: 2019-10-24

URL: CVE-2019-18413

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fj58-h2fr-3pp2

Release Date: 2019-10-24

Fix Resolution: class-validator - 0.14.0