Launchpad.net

CVE 2021-27515

url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

See the CVE page on Mitre.org for more details.