{"id":"CVE-2022-25873","aliases":["CLSA-2026-1775176070","EUVD-2022-6907","GHSA-q4q5-c5cv-2p68"],"status":"published","title":"Cross-site Scripting (XSS)","description":"The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00873,"percentile":0.59163,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-09-18T14:55:10Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"npm","package":"vuetify","fixed_in":["2.6.10"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars.npm:vuetify","fixed_in":["2.6.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vuetify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta.4"},{"fixed":"2.6.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.npm:vuetify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta.4"},{"fixed":"2.6.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vuetify/api-generator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.5-tuxcare.0"},{"fixed":"2.5.5-tuxcare.1"}]}],"versions":["2.5.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vuetify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.5-tuxcare.0"},{"fixed":"2.5.5-tuxcare.1"}]}],"versions":["2.5.5"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"vuetify","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-beta.4"},{"fixed":"2.6.10"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.npm:vuetify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta.4"},{"fixed":"2.6.10"}]}],"versions":["2.0.0","2.0.0-beta.4","2.0.0-beta.5","2.0.0-beta.6","2.0.0-beta.7","2.0.0-beta.8","2.0.0-beta.9","2.0.1","2.0.10","2.0.11","2.0.14","2.0.15","2.0.16","2.0.18","2.0.2","2.0.3","2.0.4","2.0.5","2.0.7","2.0.9","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.18","2.1.4","2.1.5","2.1.6","2.1.7","2.1.9","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.20","2.2.21","2.2.22","2.2.23","2.2.25","2.2.28","2.2.29","2.2.3","2.2.30","2.2.31","2.2.32","2.2.33","2.2.34","2.2.4","2.2.5","2.2.6","2.2.8","2.2.9","2.3.0","2.3.1","2.3.10","2.3.12","2.3.13","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.19","2.3.2","2.3.20","2.3.21","2.3.22","2.3.23","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0-beta.0","2.4.1","2.4.10","2.4.11","2.4.2","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.10","2.5.13","2.5.14","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.6","2.6.7","2.6.8","2.6.9"]}],"products":[{"vendor":"vuetifyjs","product":"vuetify"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-VUETIFY-3019858","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3024406","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVUETIFYJS-3024407","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/vuetifyjs/vuetify/commit/ade1434927f55a0eccf3d54f900f24c5fa85a176","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/vuetifyjs/vuetify/issues/15757","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://codepen.io/5v3n-08/pen/MWGKEjY","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25873","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q4q5-c5cv-2p68"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25873.json","tags":["advisory"]},{"url":"https://github.com/vuetifyjs/vuetify","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-25873","title":"Cross-site Scripting (XSS)","description":"The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.","status":"published","published":"2022-09-18T14:55:10.826Z","modified":"2024-09-17T03:28:38.073Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2022-6907","description":"The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.","status":"published","published":"2022-09-18T14:55:10Z","modified":"2024-09-17T03:28:38Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium"}],"updated_at":"2026-11-03T00:28:31.175316Z"}],"ghsa":[{"id":"GHSA-q4q5-c5cv-2p68","title":"Vuetify Cross-site Scripting vulnerability","description":"The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.","status":"published","published":"2022-09-19T00:00:28Z","modified":"2023-01-30T05:03:33Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2022-25873","description":"The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.","status":"published","published":"2022-09-18T15:15:09.66Z","modified":"2026-06-17T04:34:25.52Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"CVE-2022-25873","title":"Cross-site Scripting (XSS)","description":"The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.","status":"published","published":"2022-09-18T14:55:10.826Z","modified":"2026-10-28T02:30:27.453464405Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-q4q5-c5cv-2p68","title":"Vuetify Cross-site Scripting vulnerability","description":"The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.","status":"published","published":"2022-09-19T00:00:28Z","modified":"2023-11-08T04:08:50.276348Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"CLSA-2026-1775176070","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 2.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-15T09:47:49.443195181Z","updated_at":"2026-11-02T15:43:44.009773Z"}]}}