Executive brief
Vuetify is a widely-used Vue.js UI component framework for building web applications. A prototype pollution vulnerability in the mergeDeep utility function allows attackers to inject malicious preset configuration options that corrupt all JavaScript objects in the application, potentially causing denial of service, data theft, or unauthorized access. The vulnerability is particularly severe in applications using server-side rendering, where a single malicious request could compromise the entire server process.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in Vuetify's mergeDeep utility function, which is invoked during framework initialization to merge user-provided preset options with default configuration. An attacker can craft a malicious preset object containing __proto__ properties that pollute the JavaScript prototype chain, injecting arbitrary properties into all objects created during the application lifecycle. No authentication or user interaction is required; the attack is triggered by passing the malicious options to the Vuetify constructor. The impact includes resource exhaustion, denial of service, unauthorized data access, and potential remote code execution depending on application logic. Version 2.x is end-of-life and will not receive patches; users must either upgrade to version 3.0.0-alpha.10 or later, or engage commercial support (HeroDevs NES v2.7.4+) for post-EOL security updates.
Affected products
- Vuetify vuetify >=2.2.0-beta.2, <3.0.0-alpha.10
Timeline
- 2025-12-12: disclosed: Published by GitHub Security Advisory
- 2025-12-12: advisory: CVE-2025-8083 assigned