What’s Vulnerable › Vulnerabilities

CVE-2024-6783: Vue client-side XSS via prototype pollution

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-23 · updated 2026-06-17
• Weakness: CWE-79

Description

A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as `Object.prototype.staticClass` or `Object.prototype.staticStyle` to execute arbitrary JavaScript code.

Affected products

• vuejs Vue: from 2.0.0 through 2.7.16

References

• https://www.herodevs.com/vulnerability-directory/cve-2024-6783
• https://github.com/advisories/GHSA-g3ch-rx76-35fx
• https://www.herodevs.com/vulnerability-directory/cve-2024-6783---vue-client-side-xss

Get alerted when CVE-2024-6783 or the next vulnerability affects your stack