CVE-2025-8082: 
JavaScript vulnerability analysis and mitigation

CVE-2025-8082 is a Cross-Site Scripting (XSS) vulnerability in the VDatePicker component of the Vuetify UI framework (npm package). The flaw allows unsanitized HTML to be injected into the page via the title-date-format property, which can accept a user-created function whose output is assigned directly to the innerHTML of the title element without sanitization. It affects Vuetify versions >= 2.0.0 and < 3.0.0. The vulnerability was published on December 12, 2025, and carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory). Vuetify 2.x is End-of-Life and will not receive a patch for this issue (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The title-date-format property of the VDatePicker component accepts a developer-supplied function; the return value of that function is assigned to the innerHTML property of the date picker's title element without any HTML sanitization. If an attacker can influence the output of this function — for example, through a stored or reflected value passed into the component — arbitrary HTML and JavaScript can be injected into the DOM. The attack vector is network-based, requires no privileges, but does require user interaction (e.g., a victim visiting a page rendering the malicious date picker) (GitHub Advisory, HeroDevs Advisory). A proof-of-concept demonstrating the issue is publicly available on CodePen (CodePen PoC).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session. This can result in session cookie theft, credential harvesting, unauthorized actions performed on behalf of the victim, website defacement, or redirection to malicious sites. The confidentiality, integrity, and availability impacts are each rated Low, reflecting the scoped but meaningful risk to individual users interacting with affected applications (GitHub Advisory, HeroDevs Advisory).

A public proof-of-concept is available via CodePen, demonstrating the XSS injection through the title-date-format property (CodePen PoC). However, there is no evidence of active in-the-wild exploitation or threat actor attribution at this time (GitHub Advisory). The EPSS score is approximately 0.033% (8th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target application: Locate a web application using Vuetify 2.x (npm package vuetify >= 2.0.0, < 3.0.0) that renders a VDatePicker component with a developer-controlled or user-influenced title-date-format function.
2. Craft malicious payload: Prepare an HTML/JavaScript payload (e.g., <img src=x onerror=alert(document.cookie)>) to be returned by the title-date-format function.
3. Inject via title-date-format: If the application passes user-controlled input into the title-date-format function (e.g., via URL parameters, stored data, or configuration), supply the crafted payload so it becomes the function's return value.
4. Trigger rendering: Cause the victim to navigate to or interact with the page containing the VDatePicker component. When the component renders, the payload is assigned to innerHTML of the title element without sanitization.
5. Execute arbitrary JavaScript: The injected script executes in the victim's browser, enabling session hijacking, data exfiltration, or other malicious actions (GitHub Advisory, CodePen PoC).

• Network: Unexpected outbound requests from victim browsers to attacker-controlled domains following interaction with a date picker component; unusual POST requests containing session tokens or credentials to external endpoints.
• Logs: Server-side access logs showing requests with HTML/script tags or encoded XSS payloads in parameters associated with date picker rendering; Content Security Policy (CSP) violation reports referencing inline script execution.
• File System / Application: Presence of user-supplied or stored data containing HTML tags (e.g., <script>, <img onerror=...>) in fields that feed into the title-date-format property of VDatePicker.
• Browser / Client: Unexpected JavaScript execution or alert dialogs when interacting with date picker components; anomalous DOM mutations in the date picker title element containing injected HTML.

Since Vuetify 2.x is End-of-Life, no patch will be issued for the affected versions. The primary recommended remediation is to upgrade to Vuetify 3.x or later, which is not affected by this vulnerability (GitHub Advisory). If upgrading is not immediately feasible, the following mitigations should be applied: implement a strict Content Security Policy (CSP) to restrict inline script execution; sanitize all user-supplied input before it is passed into the title-date-format function using a library such as DOMPurify; avoid passing user-controlled data into the title-date-format property; or disable/remove the VDatePicker component if it is not critical to the application (HeroDevs Advisory).

The vulnerability was discovered and reported by HeroDevs, a company specializing in support for end-of-life open source software (HeroDevs Advisory). HeroDevs published a blog post noting two new Vuetify 2.x vulnerabilities, highlighting the risks of continuing to use EOL software (HeroDevs Blog). The Vuetify project itself has not issued a patch, consistent with the official EOL status of the 2.x branch.