PT-2025-50965 · Vuetify · Vuetify

Christiaan Swiers · CVE-2025-8082 · Published 2025-12-12 · Updated 2025-12-15

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Vuetify versions 2.0.0 through 2.9.9

Description A flaw exists in the 'VDatePicker' component of Vuetify that allows unsanitized HTML to be inserted into a webpage. This is due to the improper handling of the 'title-date-format' property, which can accept a user-defined function and assign its output to the 'innerHTML' property of the title element without proper sanitization. This can lead to a Cross-Site Scripting (XSS) attack. The title-date-format property is vulnerable. Version 2.x of Vuetify is End-of-Life and will not receive updates to address this issue.

Recommendations Versions 2.0.0 through 2.9.9 are affected and will not receive updates. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-8082

Affected Products

Vuetify

References · 5

• 🔥 https://codepen.io/herodevs/pen/dPYGPyR/775285c0fd5a08038d4c85398815d644 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8082 · Security Note
• https://herodevs.com/vulnerability-directory/cve-2025-8082 · Note
• https://twitter.com/CVEnew/status/1999876846331015334 · Twitter Post
• https://twitter.com/vuetifyjs/status/2000612285447037168 · Twitter Post