PT-2025-50969 · Vuetify · Vuetify

Christiaan Swiers · CVE-2025-8083 · Published 2025-12-12 · Updated 2025-12-15

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Vuetify versions 2.2.0-beta.2 through 3.0.0-alpha.10

Description The Preset configuration feature of Vuetify is susceptible to Prototype Pollution due to the 'mergeDeep' utility function used for merging options with defaults. A specially crafted, malicious preset can pollute JavaScript objects with arbitrary properties, potentially impacting application behavior. This could lead to resource exhaustion, denial of service, or unauthorized data access. If the application uses Server-Side Rendering (SSR), the vulnerability could affect the entire server process.

Recommendations Versions 2.2.0-beta.2 through 2.x are End-of-Life and will not receive updates. Versions 2.2.0-beta.2 through 3.0.0-alpha.9 should be updated.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-8083

Affected Products

Vuetify

References · 6

• 🔥 https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8083 · Security Note
• https://twitter.com/vuetifyjs/status/2000612285447037168 · Twitter Post
• https://twitter.com/CVEnew/status/1999876842577174586 · Twitter Post
• https://herodevs.com/vulnerability-directory/cve-2025-8083 · Note
• https://twitter.com/CveFindCom/status/1999579853515821145 · Twitter Post