CVE-2025-8101: Linkify.js Prototype Pollution & XSS - Charly

TL;DR Linkify.js 4.3.1 contains a prototype pollution vulnerability (CVE-2025-8101) that enables remote code execution through XSS. This post provides a technical deep dive into the vulnerability, exploitation techniques, and real-world impact scenarios. Technical Analysis The Core Vulnerability At its core, the vulnerability exists in the library's attribute assignment logic. Linkify.js uses a…