AIKIDO-2026-233997
@coreui/vue is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
@coreui/vueTL;DR
The v-c-tooltip and v-c-popover directives build their overlay markup by assigning the binding content (and the popover header) directly into innerHTML without any sanitization. When an application feeds attacker-influenced values into these directives, the injected markup is parsed as HTML, so payloads such as an img tag with an onerror handler or a script element execute in the victim's browser. The fix constructs the tooltip and popover DOM with document.createElement and assigns text through textContent, matching Bootstrap's html: false default so markup is rendered as inert text.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and pass untrusted content or header values into the v-c-tooltip or v-c-popover directives.
Background info
@coreui/vue is vulnerable to Cross-Site Scripting (XSS) in versions 4.0.0 - 5.9.0.
How to fix this
Upgrade the @coreui/vue library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant