Outdated Vue.js Library Has a Known Security Flaw (CVE-2018-6341)

Vulnerability Explanation

In Vue.js versions prior to 2.5.17, the server-side rendering (SSR) engine did not sanitise attribute names when processing object spread bindings via v-bind (e.g., `<div v-bind="obj">`). An attacker who can control the keys of the bound object can inject arbitrary HTML attribute strings — including sequences like `foo="bar"></div><script>alert(1)</script>` — directly into the server-rendered HTML output. Because the SSR renderer serialises attribute names without validation, the injected payload is written verbatim into the HTML string sent to the client, resulting in stored or reflected XSS depending on how the bound data originates.

Root Cause

The SSR attribute rendering module (`src/platforms/web/server/modules/attrs.js`) iterated over all keys of a v-bind spread object and emitted them as raw HTML attribute names without checking for unsafe characters. The fix introduced an `isSSRUnsafeAttr` guard that skips any attribute key containing characters that could break out of the HTML attribute context.

Technical Impact

An attacker who can influence the keys of a v-bind object in a server-rendered Vue component can inject arbitrary HTML or JavaScript into the page delivered to end users. This enables session hijacking via cookie theft, credential phishing via DOM manipulation, or delivery of malicious payloads to all users who receive the affected server-rendered page.

Severity Justification

Exploitability requires the attacker to control object keys passed to a v-bind spread in an SSR context — not a universal condition. Impact is standard reflected/stored XSS. CVSS 6.1 is consistent with typical reflected XSS scores (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Affected Components

• vue < 2.5.17
• vue-server-renderer < 2.5.17

Remediation Steps

1. Upgrade the `vue` and `vue-server-renderer` packages to 2.5.17 or later. Ideally, upgrade to the latest Vue 2.x release (2.7.x): `npm install vue@^2.7 vue-server-renderer@^2.7` or `yarn upgrade vue vue-server-renderer`.
2. If you cannot upgrade immediately, audit all SSR components for `v-bind` spread usage (i.e., `<element v-bind="someObject">`) where `someObject` keys may originate from user input, and sanitise those keys before binding.
3. After upgrading, run your existing test suite and verify SSR output does not regress. The fix is non-breaking.
4. Consider migrating to Vue 3, as Vue 2 reached end-of-life in December 2023 and no longer receives security patches.

Verification Steps

1. Run `npm list vue` or `yarn list vue` and confirm the installed version is 2.5.17 or higher.
2. In your SSR output (e.g., via `renderToString`), pass a test object with a key containing `></div><script>alert(1)</script>` as a v-bind spread value and confirm the script tag does not appear in the rendered HTML.
3. Check the Vue changelog or `node_modules/vue/package.json` to confirm the installed version.

Code Examples (html)

// Vue < 2.5.17 — attacker-controlled key escapes HTML context
// data: { attrs: { 'foo="bar"></div><script>alert(1)</script>': '' } }
<div v-bind="attrs"></div>
// SSR output (UNSAFE): <div foo="bar"></div><script>alert(1)</script></div>

// Vue >= 2.5.17 — isSSRUnsafeAttr() skips dangerous keys
// Same data input now produces safe output:
// SSR output (SAFE): <div></div>

// Upgrade in package.json:
{
  "dependencies": {
    "vue": "^2.7.16",
    "vue-server-renderer": "^2.7.16"
  }
}

Best Practices

• Never pass unsanitised user input as the keys of a v-bind spread object in SSR components — validate or allowlist attribute names at the application layer.
• Keep Vue and its companion packages (`vue-server-renderer`, `@vue/server-renderer`) pinned to the latest patch release and include them in your dependency audit schedule.
• Implement a Content Security Policy (CSP) header as a defence-in-depth measure to limit the impact of any XSS that does occur.
• Since Vue 2 is end-of-life, plan a migration to Vue 3 to continue receiving security fixes.

References

• security.snyk.io/vuln/npm:vue:20180802
• github.com/vuejs/vue/releases/tag/v2.5.17
• github.com/vuejs/vue/commit/3d36a443c755bf16f2656a8595dda9076f021a4a
• v2.vuejs.org/v2/guide/security