npm/@vue/server-renderer: high 7.2
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
Action: Upgrade @vue/server-renderer to 3.5.42 or later.
npm i @vue/server-renderer@3.5.42npm i @vue/server-renderer@3.6.0-rc.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.5.42 | - |
| 3.6.0-rc.0 | 3.6.0-rc.6 | - |
Fixed versions
| 3.5.42 | 3.6.0-rc.6 |
Sources
- osv: GHSA-g2v6-rqmx-r4w6
- https://github.com/vuejs/core/security/advisories/GHSA-g2v6-rqmx-r4w6
- https://github.com/vuejs/core/pull/15266
- https://github.com/vuejs/core/commit/a2b40db9a83b36ed9da3a16403cf8f040262d73f
- https://github.com/vuejs/core
- https://github.com/vuejs/core/releases/tag/v3.5.42
- https://github.com/vuejs/core/releases/tag/v3.6.0-rc.6
published · modified · JSON