Threats tagged 'ghsa-7g43-p94j-qr58'

CVE-2026-93751 is a medium severity vulnerability in the uri-js library (up to version 4.4.1) caused by improper UTF-8 decoding in the pctDecChars() function. This flaw allows decoding of invalid and overlong percent-encoded sequences into ASCII metacharacters, enabling attackers to craft payloads that bypass platform decoder validation. Such payloads can inject path traversal or CRLF sequences that downstream consumers may process without proper filtering.