High severityOSV Advisory· Published Jul 25, 2025· Updated Jun 17, 2026
CVE-2025-8101
CVE-2025-8101
Description
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
linkifyjsnpm | >= 4.3.1, < 4.3.2 | 4.3.2 |
Affected products
3- osv-coords2 versions
< 18.1.6-r14+ 1 more
- (no CPE)range: < 18.1.6-r14
- (no CPE)range: < 4.3.2
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-95jq-xph2-cx9hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-8101ghsaADVISORY
- caverav.cl/posts/linkify-xss/linkify-xssghsaWEB
- fluidattacks.com/advisories/charlynvdWEB
- github.com/nfrasser/linkifyjs/commit/931d3e28b68951b8f898ea4d6504696346b485b0ghsaWEB
- github.com/nfrasser/linkifyjs/releases/tag/v4.3.2nvdWEB
- www.npmjs.com/package/linkifyjsnvdWEB
News mentions
0No linked articles in our index yet.