rules-vue

RISK: <component :is> resolving to a user-controlled value lets an attacker mount arbitrary registered components, including ones with dangerous side effects. FIX: restrict :is to an allow-listed map of known components.

RISK: Binding the Vite dev server to 0.0.0.0 exposes it to the LAN; combined with DNS-rebind (CVE-2025-32395) this leaks source. FIX: keep host on localhost, or set an explicit server.allowedHosts array (never true or wildcard).

RISK: v-html renders raw HTML and is a direct XSS sink when bound to any non-static value. FIX: render as text with {{ }}, or sanitize with DOMPurify before passing to a computed property.

RISK: Vue 2 reached end-of-life on 2023-12-31 and receives no free security patches (vue-template-compiler CVE-2024-6783 unfixed upstream). FIX: upgrade to vue@^3.4, or purchase HeroDevs Never-Ending Support if migration is infeasible.

RISK: Nuxt < 3.16 is affected by SSR payload cache poisoning CVE-2025-27415 and devtools file-read CVE-2024-34343. FIX: upgrade to nuxt@^3.16.0.

RISK: Vite versions prior to 6.2.5 / 5.4.15 are vulnerable to server.fs.deny bypass chain CVE-2025-30208, CVE-2025-31125, CVE-2025-31486, CVE-2025-32395 (arbitrary file read from dev server). FIX: upgrade to vite@^6.2.5 or ^5.4.15.

RISK: vue-i18n < 9.14.2 / < 10.0.5 has template-compilation XSS (CVE-2024-52809) when translation strings contain untrusted interpolation. FIX: upgrade to vue-i18n@^9.14.2 or ^10.0.5 and prefer precompiled message bundles.

RISK: vue-router < 4.1.4 open-redirect (GHSA-m69q-h4x2-7vxp) when router.push receives a user-controlled string starting with //. FIX: upgrade to vue-router@^4.1.4 and validate target paths against an allow-list.

RISK: javascript: URLs in :href execute script when the link is clicked, bypassing Vue's text-escaping. FIX: restrict hrefs to http/https/mailto and validate the protocol before binding.

RISK: NUXT_PUBLIC_* env vars auto-populate runtimeConfig.public and ship to the browser. FIX: rename without the PUBLIC_ prefix so the value stays server-only.

RISK: Keys under runtimeConfig.public are shipped in the client bundle — placing a secret there leaks it to every visitor. FIX: move secrets to runtimeConfig (server-only); public keys must be non-sensitive identifiers.

RISK: pinia-plugin-persistedstate writes state to localStorage by default, which is readable by any injected script and persists indefinitely. FIX: exclude auth tokens from persisted paths, or use httpOnly cookies for session material.

RISK: Compiling templates from untrusted input (@vue/compiler-dom compile(userInput)) is arbitrary script execution — the root cause of CVE-2024-6783 class bugs. FIX: never pass user data to compile(); use the runtime-only Vue build and render with text interpolation.

RISK: server.fs.allow containing '/' gives the dev server read access to the entire filesystem. FIX: list only the specific project subdirectories that must be served.

RISK: server.fs.strict: false lets the dev server read files outside the project root, amplifying every server.fs.deny bypass CVE. FIX: remove the flag (default true) and list required directories in server.fs.allow.

RISK: $scopedSlots was removed in Vue 3; code using it will break on upgrade. FIX: replace with this.$slots (all slots are now scoped).

RISK: $listeners and $children were removed in Vue 3. FIX: $listeners is merged into $attrs; traverse children via template refs or provide/inject instead of $children.

RISK: new Vue() was removed in Vue 3; it silently becomes dead code after upgrade. FIX: use createApp(App).mount('#app') from 'vue'.

RISK: The .sync modifier was removed in Vue 3. FIX: use v-model:propName on the parent and defineEmits(['update:propName']) on the child.

RISK: Vue.extend was removed in Vue 3 and is a migration blocker. FIX: use defineComponent({...}) from 'vue'.

RISK: Vue.set/Vue.delete/$set/$delete were removed in Vue 3 — reactivity is Proxy-based and direct assignment works. FIX: replace with plain assignment (obj.key = val) or delete obj.key.