CVE-2025-57665
1 advisory.
npm/element-plus CVE-2025-57665: medium, EPSS 0.24%
Element Plus Link component (el-link) implements insufficient input validation for the href attribute
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.11.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-5m5x-9j46-h678
- https://nvd.nist.gov/vuln/detail/CVE-2025-57665
- https://github.com/element-plus/element-plus/pull/21711
- https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f
- https://element-plus.org/en-US/component/link.html
- https://github.com/element-plus/element-plus
- https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
- https://www.npmjs.com/package/element-plus
CVE-2025-57665 · published · modified · JSON