Input Validation Flaw in Element Plus Link Component by Element Plus
CVE-2025-57665

6.4MEDIUM

Key Information:

Vendor

Element Plus

Status
Element Plus Link
Vendor
CVE Published:
9 September 2025

What is CVE-2025-57665?

The Element Plus Link component up to version 2.10.6 is susceptible to an input validation flaw that allows users to provide potentially malicious href attributes without appropriate checks. Due to the lack of protocol validation, URL sanitization, and security headers, it becomes possible for attackers to inject harmful URLs featuring dangerous protocols like javascript:, data:, or file:. This vulnerability can lead to various security issues including Cross-Site Scripting (XSS) attacks, phishing schemes, and open redirects, particularly affecting applications leveraging user-controlled or untrusted URLs within the Element Plus framework.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/element-plus/element-plus
https://github.com/element-plus/element-plus/blob/dev/pac...
https://www.npmjs.com/package/element-plus

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.