CVE-2022-25854

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	@yaireo/tagify	>= unspecified, < 4.9.8

References

https://bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/Exploit, Patch, Third Party Advisory
https://github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7Patch, Third Party Advisory
https://github.com/yairEO/tagify/issues/988Exploit, Issue Tracking, Third Party Advisory
https://github.com/yairEO/tagify/releases/tag/v4.9.8Release Notes, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358Third Party Advisory
https://bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/Exploit, Patch, Third Party Advisory
https://github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7Patch, Third Party Advisory
https://github.com/yairEO/tagify/issues/988Exploit, Issue Tracking, Third Party Advisory
https://github.com/yairEO/tagify/releases/tag/v4.9.8Release Notes, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358Third Party Advisory

Timeline

Published: Apr 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-258557.8All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sani CVE-2022-258567.5The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReade CVE-2022-258577.5The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for c CVE-2022-258587.5The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure CVE-2022-25867.8It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that CVE-2022-258609.8Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemot CVE-2022-258627.5This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing CVE-2022-258639.8The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing i CVE-2022-258647.8Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escala CVE-2022-258659.8The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch CVE-2022-258669.8The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReada CVE-2022-258677.5The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid paylo