CVE-2022-25873
Cross-site Scripting (XSS)
MEDIUM
5.4
CVSS Score
Published: September 18, 2022 at 02:55 PM UTC
Updated: June 17, 2026 at 04:34 AM UTC
1 product affected across 1 vendorVuetify
Using vuetify by N/A?
Get instant alerts when new vulnerabilities affect vuetify - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.4
Exploit prediction
EPSS 0.9%
Description
The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
95%
v ≥ 2.0.0-beta.4v < 2.6.102.0.1 ≤ v < 2.6.102.0.0 beta42.0.0 beta52.0.0 beta62.0.0 beta72.0.0 beta82.0.0 beta92.0.0-beta.4
Affected range stops below 2.6.10, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (6)
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://codepen.io/5v3n-08/pen/MWGKEjYx_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/vuetifyjs/vuetify/commit/ade1434927f55a0eccf3d54f900f24c5fa85a176x_refsource_MISCIssue TrackingThird Party Advisory
Source: [email protected]
https://github.com/vuetifyjs/vuetify/issues/15757x_refsource_MISCThird Party Advisory
Source: [email protected]
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVUETIFYJS-3024407x_refsource_MISCThird Party Advisory
Source: [email protected]
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3024406x_refsource_MISCThird Party Advisory
Source: [email protected]
https://security.snyk.io/vuln/SNYK-JS-VUETIFY-3019858CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-79
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card