The vulnerability in validator.js versions up to 13.15.15 arises from the isURL() function's use of '://' as a delimiter to parse URL protocols. Since browsers parse protocols using ':' as the delimiter, this difference enables attackers to craft URLs that bypass the library's protocol and domain validation checks. Exploiting this can lead to XSS and open redirect vulnerabilities, categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows attackers to bypass URL validation, enabling cross-site scripting (XSS) and open redirect attacks. This can lead to partial compromise of confidentiality and integrity of affected web applications relying on validator.js for URL validation. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing additional URL validation controls outside of validator.js or avoid relying solely on the isURL() function for security-critical validation. Monitor vendor channels for updates and apply patches promptly once available.