GHSA-g3ch-rx76-35fx
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | vue-template-compiler | < 3.0.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as `Object.prototype.staticClass` or `Object.prototype.staticStyle` to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
References
External links from the advisory. They lead to third-party sites.