vuejs/vue · Security
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
- GHSA ID
- GHSA-g3ch-rx76-35fx
- CVE ID
- CVE-2024-6783
- Severity
- medium
- Published
- Updated
- CVSS
- 4.2 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS v3
- 4.2 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Description
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')