CVE-2025-8101

8.8 highEPSS 0.6%

High (8.8). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in linkifyjs 4.3.2.

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2025-07-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-95jq-xph2-cx9h	npm	linkifyjs	>=4.3.1 <4.3.2	4.3.2

References

https://fluidattacks.com/advisories/charly
https://github.com/nfrasser/linkifyjs
https://github.com/nfrasser/linkifyjs/releases/tag/v4.3.2
https://www.npmjs.com/package/linkifyjs

Check your stack JSON