Executive brief
Vue Template Compiler is a JavaScript library used to convert Vue template syntax into executable code in Vue.js applications. An attacker can exploit a prototype pollution vulnerability to inject malicious JavaScript code that executes in users' browsers, potentially stealing sensitive data or performing actions on their behalf. This affects Vue 2 applications, as Vue 2 has reached end-of-life and the vulnerability has only been patched in Vue 3.
Technical details
The vulnerability is a client-side cross-site scripting (XSS) issue caused by prototype pollution in vue-template-compiler (CWE-79). An attacker can manipulate the prototype chain of object properties such as Object.prototype.staticClass or Object.prototype.staticStyle to inject and execute arbitrary JavaScript code. The attack vector is network-based with high complexity and requires low privileges but no user interaction. An authenticated user or lower-privilege attacker can achieve confidentiality and integrity impact. The vulnerability affects Vue 2 versions (2.0.0 to <3.0.0), and patches are available in Vue 3, though Vue 2 has reached end-of-life status.
Affected products
- Vue.js vue-template-compiler 2.0.0 to <3.0.0
Timeline
- 2024-07-23: disclosed
- 2024-07-23: advisory: GHSA-g3ch-rx76-35fx published