GHSA-g3ch-rx76-35fx

Source

https://github.com/advisories/GHSA-g3ch-rx76-35fx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-g3ch-rx76-35fx/GHSA-g3ch-rx76-35fx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g3ch-rx76-35fx

Aliases

CVE-2024-6783

Published

2024-07-23T15:31:09Z

Modified

2024-08-30T15:45:15Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)

Details

A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.

Database specific

{
    "nvd_published_at": "2024-07-23T15:15:06Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-23T16:26:53Z"
}

References

Affected packages

npm / vue-template-compiler

Package

Name: vue-template-compiler; View open source insights on deps.dev
Purl: pkg:npm/vue-template-compiler

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

3.0.0