AIKIDO-2026-135497
@vue/server-renderer is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
@vue/server-rendererTL;DR
Vue's server-side renderer escapes the contents of HTML comment vnodes with a helper that strips comment delimiter sequences in a single pass. Crafted input containing overlapping comment markers can leave a residual --> sequence after stripping, letting the rendered content close the surrounding SSR comment early. When the comment content is influenced by untrusted input, this breakout allows injection of arbitrary HTML or script into the server-rendered page. The fix repeatedly strips comment token fragments until the output is stable so no closing delimiter can be reconstructed.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application server-renders comment content that can be influenced by untrusted input.
Background info
@vue/server-renderer is vulnerable to Cross-Site Scripting (XSS) in versions 3.0.0 - 3.5.39.
How to fix this
Upgrade the @vue/server-renderer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant