Medium severity5.4NVD Advisory· Published Apr 29, 2022· Updated Jun 17, 2026
CVE-2022-25854
CVE-2022-25854
Description
This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@yaireo/tagifynpm | < 4.9.8 | 4.9.8 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7nvdPatchThird Party AdvisoryWEB
- bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/nvdExploitPatchThird Party Advisory
- github.com/yairEO/tagify/issues/988nvdExploitIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-pxpf-v376-7xx5ghsaADVISORY
- github.com/yairEO/tagify/releases/tag/v4.9.8nvdRelease NotesThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-25854ghsaADVISORY
- snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358nvdThird Party AdvisoryWEB
- bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-moduleghsaWEB
News mentions
0No linked articles in our index yet.