Executive brief
Buefy is a lightweight UI component library for Vue.js applications. A cross-site scripting vulnerability in the autocomplete feature allows attackers to inject malicious HTML or JavaScript code that executes in users' browsers, potentially leading to credential theft, session hijacking, or malware distribution to anyone viewing an affected form or autocomplete list.
Technical details
The vulnerability is a DOM-based XSS (CWE-79) in the autocomplete component of buefy versions prior to 0.7.2. The root cause is the use of Vue's v-html directive to render autocomplete list items without HTML encoding user-supplied input. An attacker can craft malicious autocomplete data (e.g., via API response or local data source) containing HTML/JavaScript. When a user interacts with the autocomplete field, the injected code executes in their browser context. No special authentication is required; exploitation only requires the vulnerable autocomplete component to be active on an affected page. The vulnerability was fixed in version 0.7.2 by switching to text rendering instead of HTML rendering.
Affected products
- buefy buefy before 0.7.2
Timeline
- 2018-11-19: disclosed: XSS issue reported in b-taginput autocomplete
- 2020-09-01: patched: Advisory published; vulnerability fixed in version 0.7.2