Common Weakness Enumeration

CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page

Description

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-84 ordered by modification date.

3 reviewed records
Advisory ID NVD ID Severity PURLs Summary Last Modified
GHSA-vmhf-c436-hxj4 - MODERATE
pypi/jupyterlab

JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol

 2026-06-19
GHSA-gch2-phqh-fg9q CVE-2026-25141 CRITICAL
npm/@orval/core

Orval has Code Injection via unsanitized x-enum-descriptions using JS comments

 2026-01-31
GHSA-g9hg-qhmf-q45m CVE-2025-58444 HIGH
npm/@modelcontextprotocol/inspector

MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server

 2025-09-26