Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)

Description

Prototype Pollution in internal assign() helper in Linkify allows remote attackers to execute arbitrary JavaScript (Stored or Reflected XSS) via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2.

Recommendation

Update the linkifyjs package to the latest compatible version. Followings are version details:

Affected version(s): = 4.3.1
Patched version(s): 4.3.2

References

GHSA-95jq-xph2-cx9h
fluidattacks.com
www.npmjs.com
caverav.cl
CVE-2025-8101
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) and gives you actionable findings to investigate.

Start a free scan

Related Issues

tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475
MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049
billboard.js allows prototype pollution via the function generate - CVE-2025-49223
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection - CVE-2026-33916

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

How to Secure your NodeJs Express Javascript Application - part 1

See something that needs correcting? Let us knowUpdated June 26, 2026