p PatchFirst

CVE-2025-8101

CVE-2025-8101 · Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.

CVSS 8.8 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • linkify

    Versions
    • ≥ 4.3.1, < 4.3.2: Affected (custom)

    Update to 4.3.2

  • linkifyjs npm

    Versions
    • 4.3.1
    Affected ranges
    • SEMVER: ≥ 4.3.1, < 4.3.2

    Update to 4.3.2

Original sources

Check your server →