What’s Vulnerable › Vulnerabilities

CVE-2020-8910: Auth Bypass in Google's Closure-Library

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-26 · updated 2026-06-17
• Weakness: CWE-625

Description

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.

Affected products

• Google Closure-Library: before 20200315 — fixed in 20200315

How to fix

Upgrade to a fixed version: Google Closure-Library 20200315. Check the vendor advisory for mitigations.

References

• https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9
• https://github.com/google/closure-library/releases/tag/v20200315
• https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9
• https://github.com/google/closure-library/releases/tag/v20200315

Get alerted when CVE-2020-8910 or the next vulnerability affects your stack