High severityNVD Advisory· Published Jul 25, 2025· Updated Apr 15, 2026

CVE-2025-8101

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
linkifyjsnpm	< 4.3.2	4.3.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-95jq-xph2-cx9hghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-8101ghsaADVISORY
caverav.cl/posts/linkify-xss/linkify-xssghsaWEB
fluidattacks.com/advisories/charlynvdWEB
github.com/nfrasser/linkifyjs/releases/tag/v4.3.2nvdWEB
www.npmjs.com/package/linkifyjsnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000