medium4.2
CVE-2024-6783
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
Impact
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as `Object.prototype.staticClass` or `Object.prototype.staticStyle` to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | vue-template-compiler | >= 2.0.0, < 3.0.0 | none recorded |