vue-patched
v2.7.16-patch.3
Published
Patched Vue 2.7.16 to fix XSS (CVE-2024-6783) and ReDoS (CVE-2024-9506) security vulnerabilities.
Readme
vue-patched
A security-patched version of Vue 2.7.16 to fix the prototype pollution XSS vulnerability (CVE-2024-6783) and the ReDoS vulnerability (CVE-2024-9506).
Vue 2 is end-of-life and no longer receives official security updates. This package provides patched runtime and full (compiler-included) builds.
Based on vuejs/[email protected]. Prefer migrating to Vue 3 when you can.
Installation
Installs under the original vue name so import Vue from 'vue' / require('vue') and peer dependencies keep working.
npm
npm install vue@npm:[email protected]pnpm
pnpm add vue@npm:[email protected]Yarn
yarn add vue@npm:[email protected]Related
If you compile .vue SFCs or templates at build time (vue-loader, etc.), also replace vue-template-compiler with vue-template-compiler-patched.
CDN / full build
<script src="https://unpkg.com/[email protected]/dist/vue.js"></script><script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/vue.js"></script>License
Copyright (c) 2013-present, Yuxi (Evan) You
