CVE-2025-57665

{
  "id": "CVE-2025-57665",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-09T18:15:36.170",
  "lastModified": "2026-11-07T18:10:00.200",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol validation, URL sanitization, or security headers. This allows attackers to inject malicious URLs using dangerous protocols (javascript:, data:, file:) or redirect users to external malicious sites. While native HTML anchor elements present similar risks, UI component libraries bear additional responsibility for implementing security safeguards and providing clear risk documentation. The vulnerability enables XSS attacks, phishing campaigns, and open redirect exploits affecting applications that use Element Plus Link components with user-controlled or untrusted URL inputs."
    },
    {
      "lang": "es",
      "value": "El componente Element Plus Link (el-link) hasta la versión 2.10.6 implementa una validación de entrada insuficiente para el atributo href, creando una brecha de abstracción de seguridad que oculta vectores de ataque basados en URL. El componente pasa valores href controlados por el usuario directamente a los elementos de anclaje subyacentes sin validación de protocolo, saneamiento de URL o encabezados de seguridad. Esto permite a los atacantes inyectar URL maliciosas utilizando protocolos peligrosos (javascript_disabled: , data:, file:) o redirigir a los usuarios a sitios maliciosos externos. Si bien los elementos de anclaje HTML nativos presentan riesgos similares, las bibliotecas de componentes de UI tienen una responsabilidad adicional para implementar salvaguardias de seguridad y proporcionar documentación clara sobre los riesgos. La vulnerabilidad permite ataques XSS, campañas de phishing y exploits de redirección abierta que afectan a las aplicaciones que utilizan componentes Element Plus Link con entradas de URL controladas por el usuario o no confiables."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-10T14:14:05.335726Z",
          "id": "CVE-2025-57665",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:element-plus:element-plus:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "2.10.6",
              "matchCriteriaId": "E5D5AA53-8BF5-4A7B-90CE-530930525D4F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://element-plus.org/en-US/component/link.html",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/element-plus/element-plus",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/element-plus/element-plus/pull/21711",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://www.npmjs.com/package/element-plus",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}