Vulnerability · Published Dec 12, 2025 · Assigned by HeroDevs

CVE-2025-8082Vuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker'

Medium 6.3

In plain English

A medium-severity cross-site scripting in Vuetify. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 90.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss attack. The vulnerability occurs because the 'title-date-format' property of the 'VDatePicker' can accept a user created function and assign its output to the 'innerHTML' property of the title element without sanitization. This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0. Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	vuetify	3.0.0	GHSA-9w3x-85mw-4fwm

Affected products (as reported)

Vendor	Product	Versions
N/A	Vuetify	>=2.0.0 <3.0.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

https://www.herodevs.com/vulnerability-directory/cve-2025-8082 third-party-advisory
https://codepen.io/herodevs/pen/dPYGPyR/775285c0fd5a08038d4c85398815d644 technical-description, exploit