PT-2025-36908 · Unknown · Elements Plus!

Snowbitx · Published 2025-09-09 · Updated 2025-09-10 · CVE-2025-57665

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions: Element Plus versions through 2.10.6

Description: The Element Plus Link component (el-link) does not sufficiently validate input for the href attribute, creating a security gap. This allows attackers to inject malicious URLs using dangerous protocols (such as javascript:, data:, and file:) or redirect users to malicious sites. This enables cross-site scripting (XSS) attacks, phishing campaigns, and open redirect exploits in applications using the component with user-controlled or untrusted URL inputs.

Recommendations: Element Plus versions prior to 2.10.6 are affected. Ensure proper validation and sanitization of the href attribute before using it in the Link component. Implement security headers to mitigate potential risks associated with user-controlled URLs.

Fix

Open Redirect

XSS

Improper Encoding or Escaping of Output

RCE

Weakness Enumeration

CWE-601

CWE-79

CWE-116

CWE-20

Related Identifiers

CVE-2025-57665

GHSA-5M5X-9J46-H678

Affected Products

Elements Plus!

References · 10

• https://github.com/element-plus/element-plus/pull/21711 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-57665 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57665 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5m5x-9j46-h678 · Vendor Advisory
• https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f · Note
• https://github.com/element-plus/element-plus · Note
• https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue · Note
• https://twitter.com/CVEnew/status/1965691912226275607 · Twitter Post
• https://element-plus.org/en-US/component/link.html · Note
• https://npmjs.com/package/element-plus · Note