High severityOSV Advisory· Published Jul 25, 2025· Updated Apr 15, 2026

CVE-2025-8101

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
linkifyjsnpm	< 4.3.2	4.3.2

Affected products

Nfrasser/LinkifyjsOSV
Range: v4.3.1
osv-coords2 versions
pkg:apk/chainguard/gitlab-rails-ce-fips-18.1 pkg:npm/linkifyjs
< 18.1.6-r14+ 1 more
- (no CPE)range: < 18.1.6-r14
- (no CPE)range: < 4.3.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-95jq-xph2-cx9hghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-8101ghsaADVISORY
caverav.cl/posts/linkify-xss/linkify-xssghsaWEB
fluidattacks.com/advisories/charlynvdWEB
github.com/nfrasser/linkifyjs/releases/tag/v4.3.2nvdWEB
www.npmjs.com/package/linkifyjsnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000