GitHub Advisoryadvisory · npm

GHSA-9w3x-85mw-4fwm Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component

MEDIUM Published 2025-12-12 Modified 2025-12-12 Official page ↗
Aliases
CVE-2025-8082
Ecosystem
npm
Packages
vuetify
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-79
Reviewed
2025-12-12

Affected packages

• npm vuetify: >= 2.0.0, < 3.0.0 → fixed in 3.0.0

Description

Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss  attack. The vulnerability occurs because the 'title-date-format' property of the 'VDatePicker' can accept a user created function and assign its output to the 'innerHTML' property of the title element without sanitization. This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0. Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

Related

Alias · CVE (1)

  • CVE-2025-8082 Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References