AIKIDO-2026-624585
@vue/shared is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
@vue/sharedTL;DR
The escapeHtmlComment helper in @vue/shared sanitizes comment content during server-side rendering by stripping HTML comment delimiter sequences. It performs a single regex pass, so crafted input containing overlapping or adjacent comment markers can reconstruct a --> sequence that survives sanitization. When an application renders attacker-influenced data inside a comment vnode, this prematurely closes the server-rendered comment and lets injected markup be parsed as HTML, enabling cross-site scripting. The fix repeatedly strips comment delimiter fragments until the output is stable so no closing delimiter can be produced.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application renders untrusted content inside HTML comments during server-side rendering.
Background info
@vue/shared is vulnerable to Cross-Site Scripting (XSS) in versions 3.0.0 - 3.5.39.
How to fix this
Upgrade the @vue/shared library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant