{"action":"Upgrade @vue/server-renderer to 3.5.42 or later.","affected":[{"fixed":"3.5.42","introduced":"0"},{"fixed":"3.6.0-rc.6","introduced":"3.6.0-rc.0"}],"component":"@vue/server-renderer","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["3.5.42","3.6.0-rc.6"],"ghsa_id":"GHSA-g2v6-rqmx-r4w6","id":"tcs_01M5KFPRP2B18XAEYBYQ61K0AC","modified_at":"2026-10-05T23:00:05.334985920Z","published_at":"2026-10-05T22:50:55Z","references":["https://osv.dev/vulnerability/GHSA-g2v6-rqmx-r4w6","https://github.com/vuejs/core/security/advisories/GHSA-g2v6-rqmx-r4w6","https://github.com/vuejs/core/pull/15266","https://github.com/vuejs/core/commit/a2b40db9a83b36ed9da3a16403cf8f040262d73f","https://github.com/vuejs/core","https://github.com/vuejs/core/releases/tag/v3.5.42","https://github.com/vuejs/core/releases/tag/v3.6.0-rc.6"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-g2v6-rqmx-r4w6","url":"https://osv.dev/vulnerability/GHSA-g2v6-rqmx-r4w6"}],"summary":"@vue/server-renderer: XSS via missing CR in attribute-name blacklist"}