GHSA-g3ch-rx76-35fxMediumCVSS 4.2

vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)

Published
July 23, 2024
Last Modified
December 31, 2025

🔗 CVE IDs covered (1)

CVE-2024-6783 →

📋 Description

A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.

🎯 Affected products1

  • npm/vue-template-compiler:>= 2.0.0, < 3.0.0

🔗 References (3)