vue @vue/server-renderer vulnerabilities

Latest vue @vue/server-renderer CVEs

Newest publication first

1. GHSA-g2v6-rqmx-r4w6 @vue/server-renderer: XSS via missing CR in attribute-name blacklist

   Published 2026-10-05

   High·CVSS 7.2

   Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser sessio...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.