Listen to this Post
How the CVE Works
The vulnerability in Linkify (linkifyjs) arises from improper input sanitization, allowing attackers to inject malicious payloads into object prototypes. By manipulating user-controlled variables, an attacker can pollute the prototype chain, leading to arbitrary HTML attribute injection. This enables Cross-Site Scripting (XSS) attacks where malicious scripts execute in the victim’s browser. The flaw affects versions from 4.3.1 before 4.3.2, where unchecked modifications to `__proto__` or other prototype properties bypass security checks.
DailyCVE Form
Platform: Linkify (linkifyjs)
Version: 4.3.1
Vulnerability: Prototype Pollution → XSS
Severity: High
Date: Jul 26, 2025
Prediction: Patch by Aug 2, 2025
What Undercode Say
npm audit --production git clone https://github.com/soxtoby/linkifyjs grep -r "<strong>proto</strong>" ./src
How Exploit
const malicious = JSON.parse('{"<strong>proto</strong>":{"src":"javascript:alert(1)"}}');
linkify.options = Object.assign({}, malicious);
Protection from this CVE
- Update to Linkify 4.3.2+
- Sanitize user inputs
- Disable `__proto__` mutations
Impact
- Arbitrary script execution
- Session hijacking
- DOM manipulation
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
