ROOT-APP-NPM-GHSA-G2V6-RQMX-R4W6 GHSA-g2v6-rqmx-r4w6 in @vue/server-renderer - Patched by Root

Root has patched GHSA-g2v6-rqmx-r4w6 in the @vue/server-renderer package for Root:npm. Multiple fixed versions available...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2895 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G2V6-RQMX-R4W6...

@cbjwwwcode/common (>=0.0.2, <=0.1.5), @pocketjs/framework (>=0.7.0, <=0.15.0) +7 more potentially affected by unknown CVE via @vue/server-renderer (>=3.6.0-rc.1, <=3.6.0-rc.5)

@vue/server-renderer NPM version =3.6.0-rc.1, =0.0.2, =0.7.0, =0.0.5, =0.5.20, =1.4.33, =1.4.33, =3.6.0-rc.1, =3.6.0-rc.1, =3.6.0-rc.5 Source cves: unknown CVE Source advisory: OSV:GHSA-G2V6-RQMX-R4W6...

@cbjwwwcode/common (>=0.0.2, <=0.1.5), @pocketjs/framework (>=0.7.0, <=0.15.0) +7 more potentially affected by unknown CVE via @vue/server-renderer (>=3.6.0-rc.1, <=3.6.0-rc.5)

@vue/server-renderer NPM version =3.6.0-rc.1, =0.0.2, =0.7.0, =0.0.5, =0.5.20, =1.4.33, =1.4.33, =3.6.0-rc.1, =3.6.0-rc.1, =3.6.0-rc.5 Source cves: unknown CVE Source advisory: GHSA-G2V6-RQMX-R4W6...

@cbjwwwcode/common (>=0.0.2, <=0.1.5), @pocketjs/framework (>=0.7.0, <=0.15.0) +7 more potentially affected by unknown CVE via @vue/server-renderer (>=3.6.0-rc.1, <=3.6.0-rc.5)

@vue/server-renderer NPM version =3.6.0-rc.1, =0.0.2, =0.7.0, =0.0.5, =0.5.20, =1.4.33, =1.4.33, =3.6.0-rc.1, =3.6.0-rc.1, =3.6.0-rc.5 Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883244...

GHSA-G2V6-RQMX-R4W6 @vue/server-renderer: XSS via missing CR in attribute-name blacklist

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2895 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883244...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2895 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883248...

@cbjwwwcode/common (>=0.0.2, <=0.1.5), @pocketjs/framework (>=0.7.0, <=0.15.0) +7 more potentially affected by unknown CVE via @vue/server-renderer (>=3.6.0-rc.1, <=3.6.0-rc.5)

@vue/server-renderer NPM version =3.6.0-rc.1, =0.0.2, =0.7.0, =0.0.5, =0.5.20, =1.4.33, =1.4.33, =3.6.0-rc.1, =3.6.0-rc.1, =3.6.0-rc.5 Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883248...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2895 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: GHSA-G2V6-RQMX-R4W6...

Improper Encoding or Escaping of Output

Overview @vue/server-renderer is a @vue/server-renderer Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via isSSRSafeAttrName in packages/shared/src/domAttrConfig.ts, which fails to reject carriage return \r, U+000D characters in attribute names during...

Improper Encoding or Escaping of Output

Overview @vue/server-renderer is a @vue/server-renderer Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via isSSRSafeAttrName in packages/shared/src/domAttrConfig.ts, which fails to reject carriage return \r, U+000D characters in attribute names during...

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

PT-2026-115372

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

0xrtest (1.0.0), 8-divine (1.4.0) +1445 more potentially affected by CVE-2024-9506 via vue-server-renderer (>=2.7.4, <=2.7.16)

vue-server-renderer NPM version =2.7.4, =0.0.1, =1.1.61, =0.0.11, =0.9.29, =1.1.11, =1.0.1, =0.1.10, =0.0.3-dev, =0.0.1, =0.14.0, =0.14.1 - @alu0101353647/constant-folding 1.10.1 and more Source cves: CVE-2024-9506 Source advisory: MEND:CVE-2024-9506...

@alterjs/saber (>=0.12.0, <=0.13.0), @ambition.cn/abs-vue2-ui (>=0.0.4, <=0.0.19) +117 more potentially affected by CVE-2024-9506 via vue-server-renderer (>=2.6.1, <=2.6.14)

vue-server-renderer NPM version =2.6.1, =0.12.0, =0.0.4, =2.0.0-0, =2.1.0, =1.0.22, =2.0.0-0, =2.1.16, =1.6.24, =0.1.1, =1.1.1-alpha.0, =1.0.0, =0.0.72-alpha.0, =0.0.72-alpha.0, =2.1.0-beta, =2.1.4-alpha.0, =2.1.9 and more Source cves: CVE-2024-9506 Source advisory: MEND:CVE-2024-9506...

Vulnerable javascript dependency used in adminsidepanel.js

Description The adminsidepanel.js used Vue.js v2.6.10, which contains the vulnerable vue-server-renderer's dependency of serialize-javascript. Proof of Concept 1.Go to https://demo.limesurvey.org/tmp/assets/cb9c5d96/build.min/js/adminsidepanel.js and search for Vue.js v2.6.10 term. We can note th...