Vue.js
Monthly
Unauthenticated remote attackers can stall server-side rendering in Quasar Framework versions prior to 2.23.3 by sending a crafted User-Agent header that triggers catastrophic regex backtracking in Platform.parseSSR(). Because Platform is an auto-installed plugin, the header is parsed before routing on every SSR request, so a single malformed request keeps the Node.js event loop busy and delays or blocks all other SSR traffic - an availability-only impact (CVSS 4.0 base 8.7; our assessment CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only SSR targets are exposed; SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation builds never feed an attacker-controlled header into this path. No public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the source data.
A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely.
The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote attackers can stall server-side rendering in Quasar Framework versions prior to 2.23.3 by sending a crafted User-Agent header that triggers catastrophic regex backtracking in Platform.parseSSR(). Because Platform is an auto-installed plugin, the header is parsed before routing on every SSR request, so a single malformed request keeps the Node.js event loop busy and delays or blocks all other SSR traffic - an availability-only impact (CVSS 4.0 base 8.7; our assessment CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only SSR targets are exposed; SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation builds never feed an attacker-controlled header into this path. No public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the source data.
A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely.
The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.