CVE-2025-8083: Vuetify Prototype Pollution Vulnerability
Summary
CVE-2025-8083: Vuetify has a Prototype Pollution vulnerability. Affects vuetify versions >= 2.2.0-beta.2, < 3.0.0-alpha.10. Fixed in 3.0.0-alpha.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vuetify is a popular open-source UI library for Vue.js, designed to provide developers with a wide range of pre-built components that adhere to the Material Design specification. It enables rapid development of responsive and aesthetically pleasing web applications. However, certain versions of Vuetify are susceptible to a Prototype Pollution vulnerability, which can compromise the integrity of JavaScript objects within applications.
Vulnerability Detail
The Prototype Pollution vulnerability in Vuetify arises from the 'mergeDeep' utility function used in the Preset configuration feature. This function allows for the merging of user-defined options with default settings. If an attacker crafts a malicious preset, they can introduce arbitrary properties to all JavaScript objects, leading to unpredictable application behavior. This vulnerability can result in severe consequences, including resource exhaustion, denial of service, or unauthorized data access. Notably, if the application employs Server-Side Rendering (SSR), the entire server process could be compromised.
How To Fix
Minimum fixed version
3.0.0-alpha.10
This is the first release that contains the fix.
npm install vuetify@3.0.0-alpha.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading is not immediately feasible, consider avoiding the use of the Preset configuration feature or implementing strict validation on user-defined presets to prevent malicious input.
Conclusion
The Prototype Pollution vulnerability in Vuetify poses significant risks to applications using affected versions. It is essential to update to the patched version to safeguard against potential exploitation. Utilizing tools like Vulert can aid in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for vuetify →
FAQ
Prototype Pollution is a security vulnerability that allows an attacker to inject properties into JavaScript objects, potentially leading to unexpected behavior and security risks.
Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10 are affected by this Prototype Pollution vulnerability.
The impacts can include resource exhaustion, denial of service, unauthorized access to data, and in the case of SSR applications, compromise of the entire server process.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help identify if your application is affected by this vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for vuetify.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
