CVE-2025-57665

Root

Cause Element Plus's el-link component passes user-supplied values for the href attribute directly to the underlying HTML anchor element without any validation or sanitization [1][3]. The component does not restrict dangerous protocols such as javascript:, data:, or file:, nor does it check for external or malicious destinations [1]. This creates a security abstraction gap where developers may assume the component provides safety, while it merely reflects the raw input.

Exploitation

An attacker can supply a malicious URL as the href prop, for example javascript:alert(1) or a link to an attacker‑controlled phishing site. The component renders this value unchanged into the DOM, allowing the browser to execute script or navigate to the external destination when the link is clicked [1][4]. No authentication or special privileges are required; the attack vector is entirely client‑side and depends only on the application using user‑controlled input in the el-link component.

Impact

Successful exploitation leads to cross‑site scripting (XSS), phishing campaigns, or open redirect attacks [1]. XSS can enable session theft, credential theft, or arbitrary actions in the context of the vulnerable application. Phishing can trick users into entering sensitive information. Open redirects can be used in social engineering or to bypass URL‑based filters.

Mitigation

As of version 2.10.6, the component itself does not implement any security safeguards. The official documentation now includes a security warning advising developers to validate and sanitize URLs before passing them to el-link [4]. The documentation provides a sample sanitizeUrl function that restricts the href to allowed protocols (http:, https:) and returns # for unsafe inputs [4]. Application developers should implement such validation in their code or use a trusted URL library until the component is patched.