CVE-2025-8082

Improper neutralization of the title date in the &amp;#39;VDatePicker&amp;#39; component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss  attack. The vulnerability occurs because the &amp;#39;title-date-format&amp;#39; property of the &amp;#39;VDatePicker&amp;#39; can accept a user created function and assign its output to the &amp;#39;innerHTML&amp;#39; property of the title element without sanitization.<br /> <br /> This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.<br /> <br /> Note:<br /> Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .