CVE-2022-25854: Cross-site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-29 · updated 2026-06-17
Weakness: CWE-79

Description

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.

Affected products

@yaireo/tagify: before 4.9.8 — fixed in 4.9.8

How to fix

Upgrade to a fixed version: @yaireo/tagify 4.9.8. Check the vendor advisory for mitigations.

References

https://bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/
https://github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7
https://github.com/yairEO/tagify/issues/988
https://github.com/yairEO/tagify/releases/tag/v4.9.8
https://snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358
https://bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/
https://github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7
https://github.com/yairEO/tagify/issues/988
https://github.com/yairEO/tagify/releases/tag/v4.9.8
https://snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358

Get alerted when CVE-2022-25854 or the next vulnerability affects your stack