This repository contains a proof of concept demonstrating the XSS vulnerability in Vuetify's VCalendar component, specifically in the eventMoreText prop.
- CVE ID: CVE-2025-1461
- Affected Versions: >=2.0.0 <3.0.0
- Severity: Medium (4.6)
- Category: Cross-Site Scripting (XSS)
- Node.js (v14-16)
- npm
- Clone this repository:
git clone https://github.com/neverendingsupport/nes-vuetify-cve-2025-1461
cd nes-vuetify-pocs- Install dependencies:
npm install- Start the development server:
npm run dev- Open your browser and navigate to
http://localhost:3000
The POC demonstrates how malicious HTML/JavaScript can be injected through the eventMoreText prop of the VCalendar component. When there are more events than can be displayed, the calendar shows a "more events" link that can execute arbitrary JavaScript code.