CVE-2025-8101: Linkify

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.

Affected products

• Linkify Linkify: from 4.3.1, before 4.3.2 (fixed in 4.3.2)

Published 2025-07-25. Last modified 2026-06-17.