FKIE_CVE-2025-8083

Vulnerability from fkie_nvd - Published: 2025-12-12 20:15 - Updated: 2026-10-07 20:10
Severity
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Summary
The Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html  due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data. If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process. This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10. Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .
References
36c7be3b-2937-45df-85ea-ca7133ea542chttps://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755
36c7be3b-2937-45df-85ea-ca7133ea542chttps://www.herodevs.com/vulnerability-directory/cve-2025-8083
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://registry.npmjs.org",
          "defaultStatus": "unaffected",
          "packageName": "vuetify",
          "product": "Vuetify",
          "repo": "https://github.com/vuetifyjs/vuetify",
          "vendor": "N/A",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e=2.2.0-beta.2 \u003c3.0.0-alpha.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
    }
  ],
  "cveTags": [
    {
      "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "tags": [
        "unsupported-when-assigned"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The  Preset configuration https://v2.vuetifyjs.com/en/features/presets \u00a0feature of Vuetify is vulnerable to  Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html \u00a0due to the internal \u0027mergeDeep\u0027 utility function used to merge options with defaults.\u00a0Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application\u0027s behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes\u00a0Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2\u00a0and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ ."
    },
    {
      "lang": "es",
      "value": "La caracter\u00edstica de configuraci\u00f3n preestablecida https://v2.vuetifyjs.com/en/features/presets de Vuetify es vulnerable a la Contaminaci\u00f3n de Prototipos https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html debido a la funci\u00f3n de utilidad interna \u0027mergeDeep\u0027 utilizada para fusionar opciones con valores predeterminados. El uso de un preajuste malicioso y especialmente dise\u00f1ado puede resultar en la contaminaci\u00f3n de todos los objetos JavaScript con propiedades arbitrarias, lo que puede afectar negativamente a todos los aspectos del comportamiento de la aplicaci\u00f3n. Esto puede conducir a una amplia gama de problemas de seguridad, incluyendo el agotamiento de recursos/denegaci\u00f3n de servicio o acceso no autorizado a datos.\n\nSi la aplicaci\u00f3n utiliza Renderizado del Lado del Servidor (SSR), esta vulnerabilidad podr\u00eda afectar a todo el proceso del servidor.\n\nEste problema afecta a las versiones de Vuetify mayores o iguales a 2.2.0-beta.2 y menores que 3.0.0-alpha.10.\n\nNota:\nLa versi\u00f3n 2.x de Vuetify ha llegado al fin de su vida \u00fatil (End-of-Life) y no recibir\u00e1 ninguna actualizaci\u00f3n para abordar este problema. Para m\u00e1s informaci\u00f3n, consulte aqu\u00ed https://v2.vuetifyjs.com/en/about/eol/."
    }
  ],
  "id": "CVE-2025-8083",
  "lastModified": "2026-10-07T20:10:01.970",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7,
        "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-8083",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-12T19:38:59.651424Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-12T20:15:43.250",
  "references": [
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755"
    },
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://www.herodevs.com/vulnerability-directory/cve-2025-8083"
    }
  ],
  "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.