Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-a4v5-uv7b-gfhc
Vulnerability ID VCID-a4v5-uv7b-gfhc
Aliases CVE-2025-57665
GHSA-5m5x-9j46-h678
Summary Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol validation, URL sanitization, or security headers. This allows attackers to inject malicious URLs using dangerous protocols (javascript:, data:, file:) or redirect users to external malicious sites. While native HTML anchor elements present similar risks, UI component libraries bear additional responsibility for implementing security safeguards and providing clear risk documentation. The vulnerability enables XSS attacks, phishing campaigns, and open redirect exploits affecting applications that use Element Plus Link components with user-controlled or untrusted URL inputs.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-116 Improper Encoding or Escaping of Output
CWE-20 Improper Input Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2025-57665
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2025-57665
cvssv3.1 6.4 https://element-plus.org/en-US/component/link.html
cvssv4 6.6 https://element-plus.org/en-US/component/link.html
generic_textual MODERATE https://element-plus.org/en-US/component/link.html
ssvc Track https://element-plus.org/en-US/component/link.html
cvssv3.1 6.4 https://github.com/element-plus/element-plus
cvssv4 6.6 https://github.com/element-plus/element-plus
generic_textual MODERATE https://github.com/element-plus/element-plus
ssvc Track https://github.com/element-plus/element-plus
cvssv3.1 6.4 https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
cvssv4 6.6 https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
generic_textual MODERATE https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
ssvc Track https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
cvssv4 6.6 https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f
generic_textual MODERATE https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f
cvssv3.1 6.4 https://github.com/element-plus/element-plus/pull/21711
cvssv4 6.6 https://github.com/element-plus/element-plus/pull/21711
generic_textual MODERATE https://github.com/element-plus/element-plus/pull/21711
ssvc Track https://github.com/element-plus/element-plus/pull/21711
cvssv4 6.6 https://nvd.nist.gov/vuln/detail/CVE-2025-57665
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-57665
cvssv3.1 6.4 https://www.npmjs.com/package/element-plus
cvssv4 6.6 https://www.npmjs.com/package/element-plus
generic_textual MODERATE https://www.npmjs.com/package/element-plus
ssvc Track https://www.npmjs.com/package/element-plus
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-57665
https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f
https://nvd.nist.gov/vuln/detail/CVE-2025-57665
21711 https://github.com/element-plus/element-plus/pull/21711
element-plus https://github.com/element-plus/element-plus
element-plus https://www.npmjs.com/package/element-plus
GHSA-5m5x-9j46-h678 https://github.com/advisories/GHSA-5m5x-9j46-h678
link.html https://element-plus.org/en-US/component/link.html
link.vue https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Found at https://element-plus.org/en-US/component/link.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://element-plus.org/en-US/component/link.html
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-10T14:14:05Z/ Found at https://element-plus.org/en-US/component/link.html
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/element-plus/element-plus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/element-plus/element-plus
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-10T14:14:05Z/ Found at https://github.com/element-plus/element-plus
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-10T14:14:05Z/ Found at https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/element-plus/element-plus/pull/21711
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/element-plus/element-plus/pull/21711
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-10T14:14:05Z/ Found at https://github.com/element-plus/element-plus/pull/21711
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://nvd.nist.gov/vuln/detail/CVE-2025-57665
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Found at https://www.npmjs.com/package/element-plus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://www.npmjs.com/package/element-plus
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-10T14:14:05Z/ Found at https://www.npmjs.com/package/element-plus
Exploit Prediction Scoring System (EPSS)
Percentile 0.25878
EPSS Score 0.00092
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:14:41.787158+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/57xxx/CVE-2025-57665.json 38.6.0