CVE-2025-68457: Orejime Executable Code in HTML Attributes Vulnerability
Summary
CVE-2025-68457: Orejime has executable code in HTML attributes. Affects orejime versions < 2.3.2. Fixed in 2.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Orejime is a JavaScript library used for managing HTML attributes and data binding in web applications. It allows developers to create dynamic and interactive user interfaces by manipulating HTML elements. However, due to its handling of data attributes, Orejime is vulnerable to code injection attacks, particularly when untrusted HTML content is injected into pages.
Vulnerability Detail
The vulnerability arises from Orejime's processing of HTML elements where it converts data attributes (e.g., data-href) into standard attributes (e.g., href) without proper sanitization. This allows an attacker to embed malicious JavaScript code within these attributes, which can be executed when the page is rendered. The risk is particularly significant in scenarios where user input can be injected into the HTML, leading to potential cross-site scripting (XSS) attacks.
How To Fix
Minimum fixed version
2.3.2
This is the first release that contains the fix.
npm install orejime@2.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, sanitize any attributes that could potentially contain executable code. This can be done using libraries such as DOMPurify to clean user input before it is rendered in the HTML. Example code for sanitizing attributes:
const cleanHTML = DOMPurify.sanitize(userInput);
// Use cleanHTML in your Orejime setup.
Conclusion
The Orejime library has a vulnerability that allows for the execution of malicious code through data attributes in HTML elements. It is crucial to update to the patched version 2.3.2 to mitigate this risk. Additionally, implementing sanitization practices can help protect against potential attacks.
See every vulnerability recorded for orejime →
FAQ
The vulnerability allows for the execution of malicious JavaScript code through improperly sanitized data attributes in HTML elements.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to test your application.
If exploited, this vulnerability can lead to cross-site scripting (XSS) attacks, allowing attackers to execute arbitrary code in the context of the user's browser.
Yes, the vulnerability has been patched in version 2.3.2 of Orejime. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 1.7, indicating a low severity level.
