Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vuejs/vue

              main @ 9e88707
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Reflected XSS: 3 prior fixes. Scrutinize any change in this area.

src/platforms/web/server/modules/attrs.js: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Attackers can bypass sanitization during Server-Side Rendering (SSR) if dynamic attributes passed via v-bind are not constrained to safe characters. Filtering attribute names with a strict regex is crucial to block injected script content.

Reflected XSS: Dynamic non-string attribute values (such as arrays or objects) can bypass standard string-based escaping mechanisms, requiring explicit type casting before the output escaping functions are executed.

Cross-Site Scripting (XSS): Whitespace variations in double-mustache template interpolation can bypass default parser escaping logic, allowing raw script injection through template evaluation unless the interpolation regex is robustly structured.