Improper Input Validation in Follow-Redirects Package

CVE-2023-26159

What is CVE-2023-26159?

The Follow-Redirects package prior to version 1.15.4 includes a vulnerability related to improper input validation. This issue arises from the package's handling of URLs within the url.parse() function. When an error occurs during the creation of a new URL, it can be exploited to misinterpret the hostname. Attackers may leverage this flaw to redirect users to malicious sites, which could result in significant security implications, including information disclosure and phishing attacks. Therefore, it is crucial for users of affected versions to update to the latest version to mitigate the risk.

References