Open Redirect in ionicabizau/git-up


Reported on

Jul 10th 2021

✍️ Description

git-up improperly handles the user input such as https:/\ and interprets it as a relative path. Backslashes after the protocol are accepted by browsers and treated as normal slashes, but git-up reads them as the relative path, which could lead to SSRF, open redirects, or other unintended behavior.

🕵️‍♂️ Proof of Concept

// POC.js

var gitUp = require("git-up");


As I tested it on runkit where you can see it in action where you will see the current output:

protocol: "ssh"
port: null
resource: "https"
user: ""
pathname: "/"
hash: ""
search: ""
href: "https:/"

As you can see it interpreted the whole URL after \ as a relative path.

💥 Impact

based on the application, usage bypasses for SSRF, open redirection, and other unintended behavior

Similar CVE reports

CVE-2021-27515, CVE-2021-27516, report

We have contacted a member of the ionicabizau/git-up team and are waiting to hear back 2 years ago
x3rz modified the report
2 years ago
x3rz modified the report
2 years ago
2 years ago


any updates?

Ionică Bizău (Johnny B.) validated this vulnerability 2 years ago
x3rz has been awarded the disclosure bounty
The fix bounty is now up for grabs
2 years ago


Thank you for reporting this. A fix is welcome indeed!

Ionică Bizău (Johnny B.) marked this as fixed in 6.0.0 with commit 86bd68 a year ago
Ionică Bizău (Johnny B.) has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation