Vulnerability Directory | CVE-2025-8082 | Vuetify

Overview

Vuetify is a Vue.js UI library with Material Design components for building responsive web applications.

‍

A Cross-Site Scripting (XSS) vulnerability (CVE-2025-8082) has been identified within the Vuetify VDatePicker component, specifically in the titleDateFormat prop, which allows unsanitized HTML to be rendered on the page.

‍

Per OWASP: Cross-Site Scripting attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. An attacker can use XSS to send a malicious script to an unsuspecting user.

‍

This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.

‍

Details

Module Info

Product: Vuetify
Affected packages: vuetify
Affected versions: >=2.0.0 <3.0.0
GitHub repository: https://github.com/vuetifyjs/vuetify
Published packages: https://npmjs.com/package/vuetify
Package manager: npm
Fixed in: Vuetify NES v2.7.4

‍

Vulnerability Info

This Medium-severity vulnerability (CVSS score 6.3) is found in the v-date-picker component of Vuetify in versions >=2.0.0 <3.0.0.

‍

The issue arises from improper handling for the function passed into the title-date-format prop, which could allow an attacker to inject malicious JavaScript into the DOM. The title-date-format prop allows for the possibility of a user created function to be passed into the v-date-picker component. The output of the function is then assigned to the innerHTML property of the title element without sanitization, which then executes the code directly in the DOM.

‍

Steps To Reproduce

Create a Vue.js application using Vuetify 2.x
Add a v-date-picker component with the title-date-format prop.
Set the title-date-format prop with a function that returns malicious HTML and executable JavaScript, for example:

<v-date-picker
  v-model="selectedDate"
  :title-date-format="formatter"
></v-date-picker>

The formatter function should have executable JavaScript such as an alert that demonstrates that it was executed. For example:

export default {
  data: () => ({
    selectedDate: '2025-07-20',
  }),
  methods: {
    formatter(date) {
      return '<img src="x" onerror="alert(`XSS Triggered`)">';
    },
  },
};