CVE-2024-6783: vue Cross-site Scripting
CVSS: 4.8v3.1MediumDeferred
AliasesGHSA-g3ch-rx76-35fxCGA-224p-6x3j-74x8CGA-2f48-cmj4-5wh3CGA-2h5j-wj96-4mj2CGA-3fc7-9p6h-xpprCGA-3xmj-7pvw-mjmqCGA-4v77-f872-2v3wCGA-4x44-f545-jxh6CGA-55qh-j3qj-7qwpCGA-5g8m-9c84-wfcpCGA-5wxj-wxj6-8r97CGA-5x6r-9jc9-64q2CGA-65hc-g54p-5p7fCGA-66rc-4xr5-c4qgCGA-6ccp-4p6r-9rwgCGA-6f85-4pqm-3vrmCGA-6g9w-fwg5-cr54CGA-6p49-mcjm-c5p5CGA-6v4v-j9rc-4p7hCGA-6w6g-2j7f-4q9pCGA-6wqw-h6cx-v48gCGA-777j-gh88-qg98CGA-7rrv-3pj3-pfr9CGA-866j-f63c-6qfjCGA-8fx4-2c4c-65cwCGA-9j35-wwg9-frvgCGA-c3ww-7mqq-6fj8CGA-c3x5-j9h4-c8m9CGA-c8p5-jx3f-w526CGA-f2m5-637p-79c7CGA-f2qv-7p6m-m7qwCGA-f7f9-9wg8-v4f4CGA-fr76-6cjh-732xCGA-frf9-xrgf-84x7CGA-g4wx-cm95-qgvcCGA-g9wc-q2pj-wrvwCGA-g9wh-3776-qv56CGA-gcpx-3w36-w5xmCGA-gjx4-7qhc-2x3qCGA-gwg3-rf9g-5pj2CGA-h2hm-8cmm-jjq8CGA-h79m-3m6j-vhjqCGA-h7hw-xvj5-xvjwCGA-hj76-93pc-568xCGA-hvwm-q88j-qqq6CGA-hx9r-5px5-v98cCGA-j39f-p72h-frvrCGA-j788-prxf-ph45CGA-jj3j-gf2g-q68wCGA-jx35-cr57-v2gcCGA-jx6h-cwpc-7jxxCGA-m39j-mcpx-rxv3CGA-p9hh-mcrp-hgv3CGA-prqq-8fm9-hxvwCGA-rj8h-mq4v-4q36CGA-rm8q-w9q4-xgjcCGA-rx8m-3447-r455CGA-v3cv-h3m2-2755CGA-v4r9-6mfm-jv5cCGA-vfwf-6whm-m9x3CGA-vj8h-v475-mhh2CGA-vwrg-jxh8-cwx5CGA-w389-q57c-vh85CGA-wjmv-8ppq-wf5jCGA-x37v-4rrq-pmwjCGA-x4gj-qw79-57fgCGA-x4m6-535j-r3jgCGA-x5xr-p2v2-835qCGA-xrvm-vxf5-7286CGA-gr57-jr23-h79pCGA-qrw5-4mmm-ph4m
Published 23-07-2024Last modified 30-08-2024
Vulnerability summary
CVE-2024-6783 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in vue. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42% of scored vulnerabilities.
CVSS score
4.8/10
010
Medium · v3.1 (CVE.org)EPSS score
0.51%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 23-07-2024PublishedVulnerability first disclosed.
- 30-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as `Object.prototype.staticClass` or `Object.prototype.staticStyle` to execute arbitrary JavaScript code.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 4.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NSources4 sources · 4.2–4.8
- OSV · NpmEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
- NVDNIST4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 20-09-2026
20-09-202620-10-2026
EPSS score0.51%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard35 products
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
- commercial-gitlab-rails-ee-19.3< 19.3.3-r1
- commercial-gitlab-rails-ee-19.4< 19.4.1-r1
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
Npm1 product
- vue-template-compiler≥ 2.0.0 (No fix recorded)
Vue1 product
- vue≥ 2.0.0, ≤ 2.7.16
3 vendors · 37 products
References
5 links- github.com/advisories/GHSA-g3ch-rx76-35fxThird Party Advisory
- github.com/vuejs/vuePACKAGE