GHSA-vghf-hv5q-vc2g
High · 7.5CVSS
7.5
EPSS
—
Published
Nov 27, 2025
CISA due date
—
The record
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | validator | 0 | 13.15.22 |
| Chainguard | redisinsight | 0 | 3.0.0-r0 |
| Chainguard | redisinsight-docker-entrypoint | 0 | 3.0.0-r0 |
| Chainguard | saf | 0 | 1.5.2-r0 |
| Chainguard | sqlpad | 0 | 7.5.7-r4 |
| Chainguard | sqlpad-compat | 0 | 7.5.7-r4 |
| Wolfi | saf | 0 | 1.5.2-r0 |
| Wolfi | sqlpad | 0 | 7.5.7-r4 |
| Wolfi | sqlpad-compat | 0 | 7.5.7-r4 |
Related vulnerabilities
- CVE-2025-12758 Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering… Same vulnerability
- CVE-2025-56200 A URL validation bypass vulnerability exists in validator.js through version 13.15.15. Also affects validator
- GHSA-27v5-c462-wpq7 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards Also affects redisinsight
- GHSA-j3q9-mxjg-w52f path-to-regexp vulnerable to Denial of Service via sequential optional groups Also affects redisinsight
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects redisinsight
- CVE-2026-33532 `yaml` is a YAML parser and serialiser for JavaScript. Also affects redisinsight
- CVE-2026-4923 Impact: When using multiple wildcards, combined with at least one parameter, a regular… Also affects redisinsight
- CVE-2026-4926 Impact: A bad regular expression is generated any time you have multiple sequential… Also affects redisinsight