AIKIDO-2026-10296
node-catbox is vulnerable to Improper Input Validation
30
Low Risk
This Affects:
node-catboxTL;DR
Affected versions of this package are vulnerable to improper input validation. The uploadURL function does not sufficiently validate the user-supplied URL parameter and forwards it directly to the Catbox API. This allows malformed URLs or URLs with unsupported schemes to be processed, which can lead to unintended behavior in applications relying on the library. The issue is fixed by adding validation to ensure that only valid http or https URLs are accepted.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
node-catbox is vulnerable to Improper Input Validation in versions 0.1.0 - 4.1.0.
How to fix this
Upgrade the node-catbox library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant