XSS Filter Failure in isURL

[p-hebert]

The isURL function doesn't filter XSS strings, such as the following:
<script>console.log('injection')</script>

Found out while doing negative testing against the validation in my app.

Example simplified code:

const validator = require('validator');
console.log(validator.isURL('<script>console.log('injection')</script>'));

[p-hebert]

False positive, the XSS string doesn't go through.
Closing the issue.