This vulnerability affects the URI.parse function in the src/schemes/mailto.ts file of the garycourt uri-js library up to version 4.4.1. An attacker can remotely trigger an uncaught exception by manipulating the input argument to this function, leading to potential application instability or denial of service. The issue was reported early to the project, but no fix or official response has been provided. Exploit code has been publicly released, increasing the risk of attack.

Successful exploitation causes an uncaught exception in the URI.parse function, which may lead to application crashes or denial of service conditions. There is no indication of privilege escalation, data disclosure, or other impacts beyond the exception. The vulnerability can be triggered remotely without authentication.

No official fix or patch is currently available from the vendor. Users should monitor the project for updates and consider implementing input validation or exception handling around URI.parse calls as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.