CVE-2025-8101: Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)

Severity: high (CVSS 8.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-25 · updated 2026-06-17
Weakness: CWE-1321

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.

Affected products

Linkify: from 4.3.1 before 4.3.2 — fixed in 4.3.2

How to fix

Upgrade to a fixed version: Linkify 4.3.2. Check the vendor advisory for mitigations.

References

https://fluidattacks.com/advisories/charly
https://github.com/nfrasser/linkifyjs
https://github.com/nfrasser/linkifyjs/releases/tag/v4.3.2
https://www.npmjs.com/package/linkifyjs

Get alerted when CVE-2025-8101 or the next vulnerability affects your stack