CVE-2025-1461 PoC — Vuetify XSS through 'eventMoreText' prop of VCalendar

Source

https://github.com/neverendingsupport/nes-vuetify-cve-2025-1461

Associated Vulnerability

Title: Vuetify XSS through 'eventMoreText' prop of VCalendar (CVE-2025-1461)
Description:Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss attack. The vulnerability occurs because the default Vuetify translator will return the translation key as the translation, if it can't find an actual translation. This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0. Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

Readme

# Vuetify VCalendar XSS Vulnerability POC (CVE-2025-1461)

This repository contains a proof of concept demonstrating the XSS vulnerability in Vuetify's VCalendar component, specifically in the `eventMoreText` prop.

## Vulnerability Details

- **CVE ID**: CVE-2025-1461
- **Affected Versions**: >=2.0.0 <3.0.0
- **Severity**: Medium (4.6)
- **Category**: Cross-Site Scripting (XSS)

## Prerequisites

- Node.js (v14-16)
- npm

## Installation

1. Clone this repository:

  ```bash
  git clone https://github.com/neverendingsupport/nes-vuetify-cve-2025-1461
  cd nes-vuetify-pocs
  ```

2. Install dependencies:

  ```bash
  npm install
  ```

## Running the POC

1. Start the development server:

  ```bash
  npm run dev
  ```

2. Open your browser and navigate to `http://localhost:3000`

## Understanding the Vulnerability

The POC demonstrates how malicious HTML/JavaScript can be injected through the `eventMoreText` prop of the VCalendar component. When there are more events than can be displayed, the calendar shows a "more events" link that can execute arbitrary JavaScript code.

## Related Links

- [Vuetify Documentation](https://v2.vuetifyjs.com/)
- [Vuetify Calendar API](https://v2.vuetifyjs.com/en/api/v-calendar/)
- [Vuetify NES](https://herodevs.com/support/vuetify-nes)
- [CVE-2025-1461 Details](https://www.cve.org/CVERecord?id=CVE-2025-1461)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →