Security Resilience

CVE-2025-8083

Published
12 December 2025
Modified
07 October 2026
CVSS Score v3.1 8.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
EPSS Score 0.0034 26th percentile
Risk Priority 63 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-8083 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-8083 is a prototype pollution vulnerability in the Preset configuration feature of Vuetify, a popular Vue.js UI library. The issue stems from the internal 'mergeDeep' utility function, which merges user-provided options with defaults and allows a specially crafted malicious preset to pollute the prototypes of all JavaScript objects with arbitrary properties. This affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10, potentially disrupting application behavior across client-side and server-side rendering (SSR) contexts, where SSR exploitation could impact the entire server process.

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H). By supplying a malicious preset, attackers can achieve a range of impacts, including resource exhaustion leading to denial of service, unauthorized data access, or other behavioral alterations in the affected application.

Advisories note that Vuetify 2.x is end-of-life and will not receive patches; users should refer to the official EOL announcement for details. Vulnerable applications should upgrade to Vuetify 3.0.0-alpha.10 or later. Proof-of-concept exploits are available via references such as the CodePen demonstration and the Herodevs vulnerability directory.

EU & UK References

Vulnerability Data

The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary…

more

properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data. If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process. This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10. Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

CWE(s)
CWE-1321

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1565 Data Manipulation Impact
Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-104852Shared CWE-1321
CVE-2026-33994Shared CWE-1321
CVE-2026-48170Shared CWE-1321
CVE-2019-0230Shared CWE-1321
CVE-2026-49252Shared CWE-1321
CVE-2024-39853Shared CWE-1321
CVE-2024-57086Shared CWE-1321
CVE-2025-57352Shared CWE-1321
CVE-2024-36578Shared CWE-1321
CVE-2024-38988Shared CWE-1321

Affected Assets

—
Vuetify
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.3.6

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development catches prototype-pollution flaws before release.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.

A.8.32 Change management partial match
blocks

Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.

References