{"id":"CVE-2025-8101","aliases":["CLSA-2026-1783040464","CLSA-2026-1792864663","CLSA-2026-1793007594","CLSA-2026-1793146498","CLSA-2026-1793152364","CLSA-2026-1793156743","EUVD-2025-22758","GHSA-95jq-xph2-cx9h","ROOT-APP-NPM-CVE-2025-8101"],"status":"published","title":"Linkify 4.3.1 - Prototype Pollution \u0026 HTML Attribute Injection (XSS)","description":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.006,"percentile":0.49045,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2025-07-25T21:52:47Z","modified":"2026-10-30T19:45:58Z","fixes":[{"ecosystem":"npm","package":"linkifyjs","fixed_in":["4.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"linkifyjs","fixed_in":["4.1.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"linkify-string","fixed_in":["4.1.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"linkify-plugin-mention","fixed_in":["4.1.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"linkify-react","fixed_in":["4.1.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"linkify-html","fixed_in":["4.1.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"linkify-element","fixed_in":["4.1.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/linkifyjs","fixed_in":["4.1.3-root.io.1","4.1.3-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"linkifyjs","fixed_in":["4.1.3-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"linkifyjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"last_affected":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"linkifyjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.3-tuxcare.0"},{"fixed":"4.1.3-tuxcare.1"}]}],"versions":["4.1.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"linkify-string","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.3-tuxcare.0"},{"fixed":"4.1.3-tuxcare.1"}]}],"versions":["4.1.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"linkify-plugin-mention","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.3-tuxcare.0"},{"fixed":"4.1.3-tuxcare.1"}]}],"versions":["4.1.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"linkify-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.3-tuxcare.0"},{"fixed":"4.1.3-tuxcare.1"}]}],"versions":["4.1.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"linkify-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.3-tuxcare.0"},{"fixed":"4.1.3-tuxcare.1"}]}],"versions":["4.1.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"linkify-element","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.3-tuxcare.0"},{"fixed":"4.1.3-tuxcare.1"}]}],"versions":["4.1.3"]},{"source":"osv","ecosystem":"npm","package":"linkifyjs","ranges":[{"type":"SEMVER","events":[{"introduced":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/linkifyjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-root.io.1"},{"fixed":"4.1.3-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"linkifyjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-aikido.2"}]}]}],"products":[{"vendor":"linkify","product":"linkify"}],"references":[{"url":"https://fluidattacks.com/advisories/charly","tags":["third-party-advisory","advisory","web"]},{"url":"https://github.com/nfrasser/linkifyjs","tags":["product","package"]},{"url":"https://www.npmjs.com/package/linkifyjs","tags":["product","web"]},{"url":"https://github.com/nfrasser/linkifyjs/releases/tag/v4.3.2","tags":["patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8101","tags":["advisory"]},{"url":"https://caverav.cl/posts/linkify-xss/linkify-xss","tags":["web"]},{"url":"https://github.com/nfrasser/linkifyjs/commit/931d3e28b68951b8f898ea4d6504696346b485b0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-95jq-xph2-cx9h"},{"url":"https://registry.npmjs.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8101.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-8101","title":"Linkify 4.3.1 - Prototype Pollution \u0026 HTML Attribute Injection (XSS)","description":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.","status":"published","published":"2025-07-25T21:52:47.287Z","modified":"2025-12-03T21:04:19.184Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:32:37.680845Z"}],"euvd":[{"id":"EUVD-2025-22758","description":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.","status":"published","published":"2025-07-25T21:52:47Z","modified":"2025-12-03T21:04:19Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:10.321316Z"}],"ghsa":[{"id":"GHSA-95jq-xph2-cx9h","title":"Linkify Allows Prototype Pollution \u0026 HTML Attribute Injection (XSS)","description":"Prototype Pollution in internal `assign()` helper in Linkify allows remote attackers to execute arbitrary JavaScript (Stored or Reflected XSS) via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2.","status":"published","published":"2025-07-26T00:30:32Z","modified":"2026-06-26T20:26:12Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:40:33.778544Z"}],"nvd":[{"id":"CVE-2025-8101","description":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.","status":"published","published":"2025-07-25T22:15:25.62Z","modified":"2026-06-17T10:06:18.52Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:11:21.132141Z"}],"osv":[{"id":"CVE-2025-8101","title":"Linkify 4.3.1 - Prototype Pollution \u0026 HTML Attribute Injection (XSS)","description":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.","status":"published","published":"2025-07-25T21:52:47.287Z","modified":"2026-10-28T02:30:27.269049327Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"GHSA-95jq-xph2-cx9h","title":"Linkify Allows Prototype Pollution \u0026 HTML Attribute Injection (XSS)","description":"Prototype Pollution in internal `assign()` helper in Linkify allows remote attackers to execute arbitrary JavaScript (Stored or Reflected XSS) via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2.","status":"published","published":"2025-07-26T00:30:32Z","modified":"2026-09-10T03:50:25.994315339Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"CLSA-2026-1783040464","title":"TuxCare security update for linkifyjs (1 CVE)","description":"TuxCare rebuilt linkifyjs to address 1 CVE. Fixed in 4.1.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:41Z","modified":"2026-10-30T19:45:58.70878766Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1792864663","title":"TuxCare security update for linkify-string (1 CVE)","description":"TuxCare rebuilt linkify-string to address 1 CVE. Fixed in 4.1.3-tuxcare.1.","status":"published","published":"2026-10-24T17:57:43Z","modified":"2026-10-24T19:15:03.341914043Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793007594","title":"TuxCare security update for linkify-plugin-mention (1 CVE)","description":"TuxCare rebuilt linkify-plugin-mention to address 1 CVE. Fixed in 4.1.3-tuxcare.1.","status":"published","published":"2026-10-26T09:39:54Z","modified":"2026-10-26T13:30:02.54232919Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793146498","title":"TuxCare security update for linkify-react (1 CVE)","description":"TuxCare rebuilt linkify-react to address 1 CVE. Fixed in 4.1.3-tuxcare.1.","status":"published","published":"2026-10-28T00:14:58Z","modified":"2026-10-28T01:45:49.914599617Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793152364","title":"TuxCare security update for linkify-html (1 CVE)","description":"TuxCare rebuilt linkify-html to address 1 CVE. Fixed in 4.1.3-tuxcare.1.","status":"published","published":"2026-10-28T01:52:44Z","modified":"2026-10-28T13:45:05.725027113Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793156743","title":"TuxCare security update for linkify-element (1 CVE)","description":"TuxCare rebuilt linkify-element to address 1 CVE. Fixed in 4.1.3-tuxcare.1.","status":"published","published":"2026-10-28T03:05:43Z","modified":"2026-10-28T13:45:11.199131083Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"ROOT-APP-NPM-CVE-2025-8101","title":"CVE-2025-8101 in @rootio/linkifyjs - Patched by Root","description":"Root has patched CVE-2025-8101 in the @rootio/linkifyjs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T19:48:38Z","modified":"2026-06-05T01:30:31.618953564Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}