Improper Encoding or Escaping of Output Affecting @vue/server-renderer package, versions <3.5.42>=3.6.0-rc.1 <3.6.0-rc.6
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-VUESERVERRENDERER-20883244
- published13 Oct 2026
- disclosed5 Oct 2026
- creditUnknown
Introduced: 5 Oct 2026
New CVE NOT AVAILABLE CWE-116 (opens in a new tab)How to fix?
Upgrade @vue/server-renderer to version 3.5.42, 3.6.0-rc.6 or higher.
Overview
@vue/server-renderer is a @vue/server-renderer
Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via isSSRSafeAttrName in packages/shared/src/domAttrConfig.ts, which fails to reject carriage return (\r, U+000D) characters in attribute names during server-side rendering. An attacker who can control an attribute name can inject a CR character to break out of the attribute context and introduce arbitrary HTML, enabling cross-site scripting in the rendered output.