{"id":"EUVD-2025-203121","revision":"c35a3f17dd8f406792cd1fbc4203c0e3","records":[{"revision":"c35a3f17dd8f406792cd1fbc4203c0e3","observedAt":"2026-11-03T02:14:24.282+00:00","statement":{"source":"euvd","id":"EUVD-2025-203121","aliases":["CVE-2025-8083","GHSA-3jp5-5f8r-q2wg"],"title":"The  Preset configuration https://v2.vuetifyjs.com/en/features/presets \u00A0feature of Vuetify is vulnerable to  Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html \u00A0due to the inte…","description":"The  Preset configuration https://v2.vuetifyjs.com/en/features/presets \u00A0feature of Vuetify is vulnerable to  Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html \u00A0due to the internal 'mergeDeep' utility function used to merge options with defaults.\u00A0Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes\u00A0Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2\u00A0and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":8.6,"severity":null}],"references":["https://www.herodevs.com/vulnerability-directory/cve-2025-8083","https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203121","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 12, 2025, 7:29:06 PM","dateUpdated":"Dec 12, 2025, 7:39:20 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-203121","identifiers":["EUVD-2025-203121","CVE-2025-8083","GHSA-3jp5-5f8r-q2wg"]},"retained":false,"historicalAffected":[]}],"coverage":[]}