CVE-2025-8101
Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
- Record
CVE-2025-8101- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
EUVDEUVD-2025-22758
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
- Record
EUVD-2025-22758- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-95jq-xph2-cx9h
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)
Prototype Pollution in internal assign() helper in Linkify allows remote attackers to execute arbitrary JavaScript (Stored or Reflected XSS) via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2.
- Record
GHSA-95jq-xph2-cx9h- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
NVD
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
- Record
CVE-2025-8101- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
- Record
CVE-2025-8101- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVGHSA-95jq-xph2-cx9h
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)
Prototype Pollution in internal assign() helper in Linkify allows remote attackers to execute arbitrary JavaScript (Stored or Reflected XSS) via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2.
- Record
GHSA-95jq-xph2-cx9h- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
Show 7 moreShow less
OSVCLSA-2026-1783040464 No score
TuxCare security update for linkifyjs (1 CVE)
TuxCare rebuilt linkifyjs to address 1 CVE. Fixed in 4.1.3-tuxcare.1.
- Record
CLSA-2026-1783040464- Updated
- 2026-11-02
OSVCLSA-2026-1792864663 No score
TuxCare security update for linkify-string (1 CVE)
TuxCare rebuilt linkify-string to address 1 CVE. Fixed in 4.1.3-tuxcare.1.
- Record
CLSA-2026-1792864663- Updated
- 2026-11-02
OSVCLSA-2026-1793007594 No score
TuxCare security update for linkify-plugin-mention (1 CVE)
TuxCare rebuilt linkify-plugin-mention to address 1 CVE. Fixed in 4.1.3-tuxcare.1.
- Record
CLSA-2026-1793007594- Updated
- 2026-11-02
OSVCLSA-2026-1793146498 No score
TuxCare security update for linkify-react (1 CVE)
TuxCare rebuilt linkify-react to address 1 CVE. Fixed in 4.1.3-tuxcare.1.
- Record
CLSA-2026-1793146498- Updated
- 2026-11-02
OSVCLSA-2026-1793152364 No score
TuxCare security update for linkify-html (1 CVE)
TuxCare rebuilt linkify-html to address 1 CVE. Fixed in 4.1.3-tuxcare.1.
- Record
CLSA-2026-1793152364- Updated
- 2026-11-02
OSVCLSA-2026-1793156743 No score
TuxCare security update for linkify-element (1 CVE)
TuxCare rebuilt linkify-element to address 1 CVE. Fixed in 4.1.3-tuxcare.1.
- Record
CLSA-2026-1793156743- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-8101 No score
CVE-2025-8101 in @rootio/linkifyjs - Patched by Root
Root has patched CVE-2025-8101 in the @rootio/linkifyjs package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-8101- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linkifyjsnpm |
4.3.1 to 4.3.1 | 4.3.2 |
linkifyjsTuxCare:npm |
4.1.3-tuxcare.0 up to 4.1.3-tuxcare.1, plus listed versions 4.1.3 |
4.1.3-tuxcare.1 |
linkify-stringTuxCare:npm |
4.1.3-tuxcare.0 up to 4.1.3-tuxcare.1, plus listed versions 4.1.3 |
4.1.3-tuxcare.1 |
linkify-plugin-mentionTuxCare:npm |
4.1.3-tuxcare.0 up to 4.1.3-tuxcare.1, plus listed versions 4.1.3 |
4.1.3-tuxcare.1 |
linkify-reactTuxCare:npm |
4.1.3-tuxcare.0 up to 4.1.3-tuxcare.1, plus listed versions 4.1.3 |
4.1.3-tuxcare.1 |
linkify-htmlTuxCare:npm |
4.1.3-tuxcare.0 up to 4.1.3-tuxcare.1, plus listed versions 4.1.3 |
4.1.3-tuxcare.1 |
linkify-elementTuxCare:npm |
4.1.3-tuxcare.0 up to 4.1.3-tuxcare.1, plus listed versions 4.1.3 |
4.1.3-tuxcare.1 |
linkifyjsnpm |
4.3.1 up to 4.3.2 | 4.3.2 |
@rootio/linkifyjsRoot:npm |
before 4.1.3-root.io.1 | 4.1.3-root.io.14.1.3-root.io.2 |
linkifyjsRoot:npm |
before 4.1.3-aikido.2 | 4.1.3-aikido.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-8101 is a high vulnerability (CVSS 8.8) in Linkify, published July 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 49th percentile. Fixed in linkifyjs 4.3.2.