High · 8.8 CVE-2025-8101 EUVD-2025-22758GHSA-95jq-xph2-cx9h

Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)

Published Jul 25, 2025 · Updated Dec 3, 2025 · Assigned by Fluid Attacks

Vendor: Linkify Product: Linkify Package: linkifyjs Ecosystem: npm

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.

Affected products

Vendor	Product	Affected	Fixed
Linkify	Linkify	4.3.1 – < 4.3.2	4.3.2

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	linkifyjs	>= 4.3.1, < 4.3.2	4.3.2	GHSA-95jq-xph2-cx9h

References

https://fluidattacks.com/advisories/charly third-party-advisory
https://github.com/nfrasser/linkifyjs product
https://www.npmjs.com/package/linkifyjs product
https://github.com/nfrasser/linkifyjs/releases/tag/v4.3.2 patch