CVE-2025-8101: Linkifyjs Prototype Pollution & XSS Vulnerability
Summary
CVE-2025-8101: Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS). Affects linkifyjs versions < 4.3.2. Fixed in 4.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Linkify is a popular JavaScript library used for converting plain text URLs into clickable links. It is widely utilized in web applications to enhance user experience by automatically linking URLs, email addresses, and other types of text. The library is designed to be flexible and customizable, allowing developers to specify how links should be formatted. However, a significant vulnerability has been identified in versions prior to 4.3.2, which exposes applications to security risks, including prototype pollution and cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from an improperly controlled modification of object prototype attributes, known as 'Prototype Pollution'. This flaw allows attackers to manipulate user-controlled variables and inject malicious scripts targeting HTML attributes. As a result, an attacker could exploit this vulnerability to execute arbitrary JavaScript in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious activities.
How To Fix
Latest published version: 4.3.3 as of 22 Oct 2026
npm install linkifyjs@4.3.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.2
This is the first release that contains the fix.
npm install linkifyjs@4.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization on user inputs to mitigate the risk of XSS attacks. Additionally, avoid using Linkify in contexts where user-generated content is displayed without proper sanitization.
Conclusion
The Linkify vulnerability (CVE-2025-8101) poses significant risks due to prototype pollution and XSS attacks. It is crucial for developers using this library to update to version 4.3.2 or later to safeguard their applications. Implementing proper input validation and utilizing tools like Vulert can further enhance security.
See every vulnerability recorded for linkifyjs →
FAQ
Prototype Pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, potentially leading to unexpected behavior in the application.
Exploiting this vulnerability can allow attackers to execute malicious scripts in the user's browser, leading to data theft, session hijacking, or other security breaches.
The vulnerability affects Linkify versions from 4.3.1 before 4.3.2. It is crucial to update to version 4.3.2 or later to mitigate the risk.
Implement input validation and sanitization for user inputs to reduce the risk of XSS attacks, and avoid using Linkify in contexts with untrusted content.
You can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
