CVE-2026-44889: Urljoin Missing Protocol Relative Check
The application calls `urljoin` and returns the result without validating if the target URL starts with `//`. `urljoin` interprets protocol-relative URLs as absolute network locations, which can lead to Open Redirect vulnerabilities if the output is used in a Location header. Ensure inputs are validated (e.g., using `startswith('//')`) or explicitly constrai
Pythongreprules fetch cve-2026-44889-urljoin-missing-protocol-relative-check --engine opengrepDescription
The application calls `urljoin` and returns the result without validating if the target URL starts with `//`. `urljoin` interprets protocol-relative URLs as absolute network locations, which can lead to Open Redirect vulnerabilities if the output is used in a Location header. Ensure inputs are validated (e.g., using `startswith('//')`) or explicitly constrai
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.