vue3-element-admin
CVE-2025-15372
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H because notice creation requires high-privilege access; S:C and UI:R because XSS executes in a victim's browser context; C:L added for session token exposure risk.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting in youlaitech vue3-element-admin through version 3.4.0 allows a remote attacker with high privileges to inject malicious JavaScript via the Notice Handler component (src/views/system/notice/index.vue). Successful exploitation requires a privileged account to craft the payload and a separate user interaction to trigger script execution in the victim's browser. A public proof-of-concept exploit exists, though EPSS at 0.04% (14th percentile) and absence from CISA KEV indicate no widespread exploitation; the vendor was unresponsive to coordinated disclosure, leaving no vendor patch available.
Technical ContextAI
vue3-element-admin is an open-source Vue 3 and Element Plus-based administrative dashboard framework by youlaitech, used to scaffold backend management UIs. The vulnerability resides in src/views/system/notice/index.vue, the frontend component responsible for rendering system-wide notices to users. CWE-79 (Improper Neutralization of Input During Web Page Generation - XSS) indicates that notice content or a related field is rendered without proper output encoding, likely via Vue 3's v-html directive or an equivalent unsafe rendering path that bypasses the framework's default HTML escaping. The CPE string cpe:2.3:a:youlai:vue3-element-admin:*:*:*:*:*:*:*:* covers all versions through 3.4.0 with no upper-bound patched release identified.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to coordinated disclosure, and no patched version is known. As a primary compensating control, restrict access to the notice creation and editing functionality exclusively to the most trusted administrator accounts, minimizing the attacker pool who can inject payloads. Developers should audit src/views/system/notice/index.vue for any use of Vue 3's v-html directive or innerHTML assignments and replace these with safe text-binding equivalents (v-text or {{ }}), which apply automatic HTML escaping. Deploying a strict Content Security Policy (CSP) header - specifically script-src 'self' - can prevent injected inline scripts from executing even if the rendering flaw persists, though this may require testing against existing legitimate functionality. The public exploit report is documented at https://github.com/AnalogyC0de/public_exp/blob/main/archives/vue3-element-admin/report.md and should be reviewed to confirm the exact injection point before applying targeted fixes.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today