Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)

Description

Prototype Pollution in internal assign() helper in Linkify allows remote attackers to execute arbitrary JavaScript (Stored or Reflected XSS) via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2.

Recommendation

Update the linkifyjs package to the latest compatible version. Followings are version details:

• Affected version(s): = 4.3.1
• Patched version(s): 4.3.2

References

• GHSA-95jq-xph2-cx9h
• fluidattacks.com
• www.npmjs.com
• caverav.cl
• CVE-2025-8101
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475
• MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049
• billboard.js allows prototype pollution via the function generate - CVE-2025-49223
• Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection - CVE-2026-33916

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

linkifyjs