{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.11.0"}],"component":"element-plus","cve_ids":["CVE-2025-57665"],"ecosystem":"npm","epss":0.00236,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-5m5x-9j46-h678","id":"tcs_01M5KF43NRYHFKKG3N6XVT0B7X","modified_at":"2025-09-12T19:05:43Z","published_at":"2025-09-09T18:31:25Z","references":["https://osv.dev/vulnerability/GHSA-5m5x-9j46-h678","https://nvd.nist.gov/vuln/detail/CVE-2025-57665","https://github.com/element-plus/element-plus/pull/21711","https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f","https://element-plus.org/en-US/component/link.html","https://github.com/element-plus/element-plus","https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue","https://www.npmjs.com/package/element-plus"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-5m5x-9j46-h678","url":"https://osv.dev/vulnerability/GHSA-5m5x-9j46-h678"},{"source":"nvd","source_id":"CVE-2025-57665","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57665"}],"summary":"Element Plus Link component (el-link) implements insufficient input validation for the href attribute"}