Is CVE-2025-8083 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-8083 being exploited in the wild.

How severe is CVE-2025-8083?

High severity, with a CVSS score of 8.6, published 12 December 2025.

Which products and versions are affected?

vuetify (npm) SEMVER:introduced=2.2.0-beta.2,fixed=3.0.0-alpha.10.

Is there a fix for CVE-2025-8083?

Yes. vuetify (npm): upgrade to 3.0.0-alpha.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-8083 attacked?

It is attacked over the network.

Am I affected by CVE-2025-8083?

Check whether you run vuetify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8083: Vuetify prototype pollution in mergeDeep utility

CVE-2025-8083 · Severity: high · CVSS 8.6 · Published 2025-12-12

Vuetify is a widely-used Vue.js UI component framework for building web applications. A prototype pollution vulnerability in the mergeDeep utility function allows attackers to inject malicious preset configuration options that corrupt all JavaScript objects in the application, potentially causing denial of service, data theft, or unauthorized access. The vulnerability is particularly severe in applications using server-side rendering, where a single malicious request could compromise the entire server process.

Technologies: vuetify (npm). Vendors: npm.

Quick answers

Is CVE-2025-8083 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-8083 being exploited in the wild.
How severe is CVE-2025-8083?: High severity, with a CVSS score of 8.6, published 12 December 2025.
Which products and versions are affected?: vuetify (npm) SEMVER:introduced=2.2.0-beta.2,fixed=3.0.0-alpha.10.
Is there a fix for CVE-2025-8083?: Yes. vuetify (npm): upgrade to 3.0.0-alpha.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-8083 attacked?: It is attacked over the network.
Am I affected by CVE-2025-8083?: Check whether you run vuetify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vuetify (npm): upgrade to 3.0.0-alpha.10 or later
```
npm install vuetify@3.0.0-alpha.10
```

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in Vuetify's mergeDeep utility function, which is invoked during framework initialization to merge user-provided preset options with default configuration. An attacker can craft a malicious preset object containing __proto__ properties that pollute the JavaScript prototype chain, injecting arbitrary properties into all objects created during the application lifecycle. No authentication or user interaction is required; the attack is triggered by passing the malicious options to the Vuetify constructor. The impact includes resource exhaustion, denial of service, unauthorized data access, and potential remote code execution depending on application logic. Version 2.x is end-of-life and will not receive patches; users must either upgrade to version 3.0.0-alpha.10 or later, or engage commercial support (HeroDevs NES v2.7.4+) for post-EOL security updates.

Affected products

Vuetify vuetify >=2.2.0-beta.2, <3.0.0-alpha.10

Identifiers

CVE-2025-8083
GHSA-3jp5-5f8r-q2wg

Timeline

2025-12-12: disclosed: Published by GitHub Security Advisory
2025-12-12: advisory: CVE-2025-8083 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.