CVE-2026-44889: Urljoin Missing Protocol Relative Check
The application calls `urljoin` and returns the result without validating if the target URL starts with `//`. `urljoin` interprets protocol-relative URLs as absolute network locations, which can lead to Open Redirect vulnerabilities if the output is used in a Location header. Ensure inputs are validated (e.g., using `startswith('//')`) or explicitly constrai
Pythongreprules fetch cve-2026-44889-urljoin-missing-protocol-relative-check --engine opengrepDescription
The application calls `urljoin` and returns the result without validating if the target URL starts with `//`. `urljoin` interprets protocol-relative URLs as absolute network locations, which can lead to Open Redirect vulnerabilities if the output is used in a Location header. Ensure inputs are validated (e.g., using `startswith('//')`) or explicitly constrai
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0