CVE-2022-25873: Vuetifyjs Vuetify

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.

Affected products

• Vuetifyjs Vuetify: from 2.0.1, before 2.6.10 (fixed in 2.6.10); version 2.0.0 only

Published 2022-09-18. Last modified 2026-06-17.