Prototype Pollution in Linkify

CVE-2025-8101

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.

Vulnerability class: Prototype Pollution

EPSS: 0.005 (40.0th percentile) — read the EPSS interpretation.