Skip to content
Sign in
4.6 Medium

CVE-2022-25873 The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper…

Description

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.

Affected products and versions

Product Affected versions Fixed in
vuetify 2.6 earliest → < 2.6.10 2.6.10
vuetify 2.0 2.0.0-beta.4 → latest No fix stated

Other CVEs of vuetify

The 4 CVEs of vuetify →
CVE-2025-8083 The Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to Prototype… 8.6 High CVE-2025-8082 Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be… 6.3 Medium CVE-2025-1461 Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows… 5.6 Medium
Track this CVE