{"id":"GHSA-3jp5-5f8r-q2wg","revision":"cc46f4d7dc0647a69e1c85678ba4c4d3","records":[{"revision":"cc46f4d7dc0647a69e1c85678ba4c4d3","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-3jp5-5f8r-q2wg","aliases":["CVE-2025-8083"],"title":"Vuetify has a Prototype Pollution vulnerability","description":"The Preset configuration\u00A0feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults.\u00A0Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes\u00A0Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2\u00A0and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .","state":0,"publishedAt":"2025-12-12T21:31:38+00:00","modifiedAt":"2026-09-10T03:50:31.3711537+00:00","affected":[{"ecosystem":"npm","name":"vuetify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.2.0-beta.2"},{"kind":"fixed","version":"3.0.0-alpha.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-8083","https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755","https://github.com/vuetifyjs/vuetify","https://www.herodevs.com/vulnerability-directory/cve-2025-8083"],"sourceUrl":"https://github.com/advisories/GHSA-3jp5-5f8r-q2wg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3jp5-5f8r-q2wg","identifiers":["GHSA-3jp5-5f8r-q2wg","CVE-2025-8083"]},"retained":false,"historicalAffected":[]}],"coverage":[]}