CVE-2025-1461 Vuetify XSS through 'eventMoreText' prop of VCalendar
Attackers can inject malicious scripts via the eventMoreText prop in Vuetify's VCalendar component, affecting the end-of-life version 2.x.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1461?
CVE-2025-1461 is a medium-severity cross-site scripting vulnerability in Vuetify, published on 28 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss attack. The vulnerability occurs because the default Vuetify translator will return the translation key as the translation, if it can't find an actual translation.
This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.
Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .
Weakness: CWE-79
Which versions are affected by CVE-2025-1461?
How do I fix CVE-2025-1461?
Product is end of life, replace it.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-1461 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1461 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-vr9v-xw27-65fc.