Medium severity4.6NVD Advisory· Published Sep 18, 2022· Updated Jun 17, 2026
CVE-2022-25873
CVE-2022-25873
Description
The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vuetifynpm | >= 2.0.0-beta.4, < 2.6.10 | 2.6.10 |
org.webjars.npm:vuetifyMaven | >= 2.0.0-beta.4, < 2.6.10 | 2.6.10 |
Affected products
10cpe:2.3:a:vuetifyjs:vuetify:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:vuetifyjs:vuetify:*:*:*:*:*:*:*:*range: >=2.0.1,<2.6.10
- cpe:2.3:a:vuetifyjs:vuetify:2.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:vuetifyjs:vuetify:2.0.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:vuetifyjs:vuetify:2.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:vuetifyjs:vuetify:2.0.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:vuetifyjs:vuetify:2.0.0:beta8:*:*:*:*:*:*
- cpe:2.3:a:vuetifyjs:vuetify:2.0.0:beta9:*:*:*:*:*:*
- vuetify/vuetifydescription
- ghsa-coords2 versions
>= 2.0.0-beta.4, < 2.6.10+ 1 more
- (no CPE)range: >= 2.0.0-beta.4, < 2.6.10
- (no CPE)range: >= 2.0.0-beta.4, < 2.6.10
Patches
Vulnerability mechanics
References
8- github.com/vuetifyjs/vuetify/commit/ade1434927f55a0eccf3d54f900f24c5fa85a176nvdPatchThird Party AdvisoryWEB
- codepen.io/5v3n-08/pen/MWGKEjYnvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-q4q5-c5cv-2p68ghsaADVISORY
- github.com/vuetifyjs/vuetify/issues/15757nvdIssue TrackingThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-25873ghsaADVISORY
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVUETIFYJS-3024407nvdThird Party AdvisoryWEB
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3024406nvdThird Party AdvisoryWEB
- security.snyk.io/vuln/SNYK-JS-VUETIFY-3019858nvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.