Skip to main content
cve.nowby Sazabi
← npm
npmPackage

vuetify

4 known vulnerabilities (1 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
4.3.2 (Nov 3, 2026): no advisory with comparable ranges affects it; 3 advisories (CVE-2025-8083, CVE-2025-8082, CVE-2025-1461) can't be checked against versions
Newest unaffected release
4.3.2 (Nov 3, 2026), the latest release, not counting 3 advisories without comparable ranges
Advisories
4 · 1 high, 3 medium
Weekly downloads
1.4M
Dependents
85
Releases
500+ since 1.4.4 (Jan 29, 2019)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-8083
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2025-8082
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2025-1461
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-25873
    Affects 2.0.0-beta.4 to 2.6.9 (2.6.10 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 4

  • Vuetify Prototype Pollution via Preset options

    Affected: versions >=2.2.0-beta.2 <3.0.0-alpha.10; from 2.2.0-beta.2, fixed in 3.0.0-alpha.10.

  • CVE-2025-8082Medium 6.3

    Vuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker'

    Affected: versions >=2.0.0 <3.0.0; from 2.0.0, fixed in 3.0.0.

  • CVE-2025-1461Medium 5.6

    Vuetify XSS through 'eventMoreText' prop of VCalendar

    Affected: versions >=2.0.0 <3.0.0.

  • CVE-2022-25873Medium 4.6

    Cross-site Scripting (XSS)

    Affected: from 2.0.0-beta.4, fixed in 2.6.10.

    Fixed in 2.6.10 (released Sep 12, 2022, 6 days before disclosure).

    The latest release, 4.3.2, is not affected.

    6.8% of vuetify downloads last week were affected versions (107.7K).