Executive brief
Vuetify is a popular Vue.js UI component library used by many web applications to build user interfaces. A cross-site scripting (XSS) vulnerability in the VDatePicker date selection component allows attackers to inject malicious scripts into web pages, potentially compromising user sessions, stealing credentials, or redirecting users to malicious sites. This affects the widely-used 2.x version series, which is now end-of-life and will receive no further updates.
Technical details
The vulnerability is a reflected/stored cross-site scripting (XSS) flaw in the VDatePicker component's title-date-format property. The root cause is improper sanitization: the component accepts a user-supplied function, executes it, and directly assigns its output to the innerHTML property of the title element without HTML encoding or sanitization. An attacker can craft a malicious date format function that returns unsanitized HTML/JavaScript, which executes in the context of the victim's browser. Attack vector is network; user interaction is required (the victim must interact with the affected VDatePicker). The vulnerability affects Vuetify versions 2.0.0 through 2.x; version 3.0.0 and later are not affected. No patch is planned for the end-of-life 2.x branch.
Affected products
- Vuetify Vuetify 2.0.0 through 2.x (end-of-life)
Timeline
- 2025-12-12: disclosed
- 2026-09-10: other: Advisory modified