CVE-2022-25873: Vuetify Cross-site Scripting Vulnerability
Summary
CVE-2022-25873: Vuetify Cross-site Scripting vulnerability. Affects vuetify versions >= 2.0.0-beta.4, < 2.6.10. Fixed in 2.6.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vuetify is an open-source component framework for Vue.js that allows developers to build responsive and attractive user interfaces. It provides a wide range of pre-designed components and themes, making it easier to create visually appealing web applications. However, versions 2.0.0-beta.4 and earlier than 2.6.10 of Vuetify are vulnerable to a Cross-site Scripting (XSS) attack. This vulnerability stems from improper input sanitization in the 'eventName' function within the VCalendar component.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in Vuetify allows an attacker to inject malicious scripts into web pages viewed by users. By exploiting this vulnerability, an attacker can execute arbitrary code in the context of the victim's browser, potentially leading to various security risks. This vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: 4.3.0 as of 23 Oct 2026
npm install vuetify@4.3.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6.10
This is the first release that contains the fix.
npm install vuetify@2.6.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize user input before passing it to the 'eventName' function within the VCalendar component. This can be achieved by using appropriate input validation and sanitization techniques, such as encoding special characters and filtering out potentially harmful content. Here's an example of how to sanitize user input in JavaScript:
function sanitizeInput(input) {
// Perform input sanitization here
return sanitizedInput;
}
// Usage
const sanitizedInput = sanitizeInput(userInput);
// Pass sanitizedInput to the 'eventName' function
Conclusion
In conclusion, the Vuetify package versions 2.0.0-beta.4 and earlier than 2.6.10 are vulnerable to a Cross-site Scripting (XSS) attack. It is crucial for developers to upgrade to the latest secure version of Vuetify (2.6.10 or later) to mitigate the risk of XSS attacks. Additionally, implementing proper input validation and sanitization techniques can provide a temporary workaround until the upgrade is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vuetify →
FAQ
Vuetify is an open-source component framework for Vue.js that helps developers build visually appealing and responsive user interfaces.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. This can lead to various security risks, such as stealing sensitive information or performing unauthorized actions on behalf of the user.
The vulnerability in Vuetify allows an attacker to execute arbitrary code in the victim's browser, potentially leading to various security risks. This can include stealing sensitive information, performing unauthorized actions, or manipulating the content of the web page.
To fix this vulnerability, it is recommended to upgrade Vuetify to version 2.6.10 or later. This version includes proper input sanitization to prevent the execution of malicious scripts.
As a temporary workaround, developers can manually sanitize user input before passing it to the vulnerable function. This involves implementing input validation and sanitization techniques to filter out potentially harmful content.
References
Related vulnerabilities
Recent vulnerabilities recorded for vuetify.
