GHSA-95jq-xph2-cx9h

Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)

Source: GitHub Advisory Database (reviewed) High CVE-2025-8101

Packages

Ecosystem	Package	Affected	Fixed in
npm	linkifyjs	>= 4.3.1, < 4.3.2	4.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Prototype Pollution in internal `assign()` helper in Linkify allows remote attackers to execute arbitrary JavaScript (Stored or Reflected XSS) via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-8101 advisory
https://github.com/nfrasser/linkifyjs/commit/931d3e28b68951b8f898ea4d6504696346b485b0 web
https://caverav.cl/posts/linkify-xss/linkify-xss web
https://fluidattacks.com/advisories/charly web
https://github.com/nfrasser/linkifyjs package
https://github.com/nfrasser/linkifyjs/releases/tag/v4.3.2 web
https://www.npmjs.com/package/linkifyjs web