npm/linkifyjs CVE-2025-8101: high 8.8, EPSS 0.60%
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)
Action: Upgrade linkifyjs to 4.3.2 or later.
npm i linkifyjs@4.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.3.1 | 4.3.2 | - |
Fixed versions
| 4.3.2 |
Sources
- osv: GHSA-95jq-xph2-cx9h
- nvd: CVE-2025-8101
- https://github.com/nfrasser/linkifyjs/commit/931d3e28b68951b8f898ea4d6504696346b485b0
- https://caverav.cl/posts/linkify-xss/linkify-xss
- https://fluidattacks.com/advisories/charly
- https://github.com/nfrasser/linkifyjs
- https://github.com/nfrasser/linkifyjs/releases/tag/v4.3.2
- https://www.npmjs.com/package/linkifyjs
CVE-2025-8101 · published · modified · JSON