Verified

ghsa:GHSA-G2V6-RQMX-R4W6: @vue/server-renderer < 3.5.42, >= 3.6.0-rc.0, < 3.6.0-rc.6

@vue/server-renderer: XSS via missing CR in attribute-name blacklist. Affected range: < 3.5.42. Fixed version: 3.5.42. Affected range: >= 3.6.0-rc.0, < 3.6.0-rc.6. Fixed version: 3.6.0-rc.6.

Affected technology

@vue/server-renderer · < 3.5.42
Vendor not specified by the source

@vue/server-renderer · >= 3.6.0-rc.0, < 3.6.0-rc.6
Vendor not specified by the source

Component: Not specified by the source
Function: ssrRenderDynamicAttr, isSSRSafeAttrName, returned

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 12-Oct-2026 10:15 UTC

Product: @vue/server-renderer
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-g2v6-rqmx-r4w6.html