CVE-2022-25854: Tagify Project Tagify

Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days.

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.

Affected products

• Tagify Project Tagify: before 4.9.8 (fixed in 4.9.8)

Published 2022-04-29. Last modified 2026-06-17.