p PatchFirst

PatchFirst · Latest vulnerabilities

@vue/server-renderer vulnerabilities

Vulnerability published for @vue/server-renderer in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-g2v6-rqmx-r4w6

    High · CVSS 7.2Fix available

    @vue/server-renderer: XSS via missing CR in attribute-name blacklist

    ## Description `@vue/server-renderer` was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already running the app's own JS. `ssrRenderAttrs()` (in `packages/server-renderer/src/helpers/ssrRenderAttrs.ts`) is what compiled SSR output calls for something like `<div v-bind="userObject">`. It loops over the object's own keys and, for each one, renders it as an HTML attribute: ```ts export function ssrRenderDynamicAttr( key: string, value:

    @vue/server-renderer @vue/server-rendererNode.js
    • Update to 3.5.42
    • Update to 3.6.0-rc.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →