{"id":"CVE-2025-8083","aliases":["CLSA-2026-1775176071","CLSA-2026-1775176101","EUVD-2025-203121","GHSA-3jp5-5f8r-q2wg","ROOT-APP-NPM-CVE-2025-8083"],"status":"published","title":"Vuetify Prototype Pollution via Preset options","description":"The  Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to  Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html  due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00337,"percentile":0.27275,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2025-12-12T19:29:06Z","modified":"2026-10-30T19:45:50Z","fixes":[{"ecosystem":"npm","package":"vuetify","fixed_in":["3.0.0-alpha.10"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"vuetify","fixed_in":["2.6.13-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vuetify","fixed_in":["2.6.13-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"vuetify","fixed_in":["2.6.13-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vuetify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0-beta.2"},{"fixed":"3.0.0-alpha.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vuetify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.13-tuxcare.0"},{"fixed":"2.6.13-tuxcare.1"}]}],"versions":["2.6.13"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vuetify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.5-tuxcare.0"},{"fixed":"2.5.5-tuxcare.2"}]}],"versions":["2.5.5","2.5.5-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"vuetify","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0-beta.2"},{"fixed":"3.0.0-alpha.10"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vuetify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.13-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vuetify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.13-aikido.1"}]}]}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-8083","tags":["third-party-advisory","web"]},{"url":"https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755","tags":["technical-description","exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8083","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3jp5-5f8r-q2wg"},{"url":"https://github.com/vuetifyjs/vuetify","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-8083","title":"Vuetify Prototype Pollution via Preset options","description":"The  Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to  Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html  due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .","status":"published","published":"2025-12-12T19:29:06.926Z","modified":"2025-12-12T19:39:20.731Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-203121","description":"The  Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to  Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html  due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .","status":"published","published":"2025-12-12T19:29:06Z","modified":"2025-12-12T19:39:20Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:05.821921Z"}],"ghsa":[{"id":"GHSA-3jp5-5f8r-q2wg","title":"Vuetify has a Prototype Pollution vulnerability","description":"The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .","status":"published","published":"2025-12-12T21:31:38Z","modified":"2025-12-12T22:14:54Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:39:13.204325Z"}],"nvd":[{"id":"CVE-2025-8083","description":"The  Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to  Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html  due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .","status":"published","published":"2025-12-12T20:15:43.25Z","modified":"2026-10-07T20:10:01.97Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:11:49.861863Z"}],"osv":[{"id":"GHSA-3jp5-5f8r-q2wg","title":"Vuetify has a Prototype Pollution vulnerability","description":"The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .","status":"published","published":"2025-12-12T21:31:38Z","modified":"2026-09-10T03:50:31.371153653Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"CLSA-2026-1775176071","title":"TuxCare security update for vuetify (1 CVE)","description":"TuxCare rebuilt vuetify to address 1 CVE. Fixed in 2.6.13-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-30T19:45:50.440929296Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775176101","title":"TuxCare security update for vuetify (2 CVEs)","description":"TuxCare rebuilt vuetify to address 2 CVEs. Fixed in 2.5.5-tuxcare.2.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-30T19:45:50.562596054Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"ROOT-APP-NPM-CVE-2025-8083","title":"CVE-2025-8083 in @rootio/vuetify - Patched by Root","description":"Root has patched CVE-2025-8083 in the @rootio/vuetify package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-27T11:32:25Z","modified":"2026-07-27T13:15:19.369434643Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}