PT-2025-23120 · Vuetify · Vuetify

Abze · Published 2025-05-28 · Updated 2025-06-10 · CVE-2025-1461

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Vuetify versions 2.0.0 through 2.x

Description The issue arises from the improper neutralization of the eventMoreText property value in the VCalendar component, allowing unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) attack. The vulnerability occurs because the default Vuetify translator returns the translation key as the translation if it cannot find an actual translation.

Recommendations For versions 2.0.0 through 2.x, as these versions are End-of-Life and will not receive updates, consider migrating to a supported version of Vuetify to address this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-1461

Affected Products

Vuetify

References · 5

• 🔥 https://github.com/neverendingsupport/nes-vuetify-cve-2025-1461 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1461 · Security Note
• https://twitter.com/cursor_babe/status/1932429606264725884 · Twitter Post
• https://twitter.com/CVEnew/status/1927784571375911250 · Twitter Post
• https://herodevs.com/vulnerability-directory/cve-2025-1461 · Note