CVE-2024-9506: vue
CVSS: 3.7v3.1LowDeferred
AliasesCGA-5r5f-c92j-wgvhCGA-9c5j-g6cj-mrjxCGA-c6w5-v476-697pCGA-fg2h-f365-rqrjGHSA-5j4c-8p2g-v4jxCGA-236j-pmxq-hw29CGA-2f94-p8x4-53v2CGA-2fgr-ppqq-55m2CGA-2h98-v28v-4h5qCGA-2hc2-r474-mpqjCGA-37v7-qmj2-jph5CGA-39q8-6gr3-c46gCGA-3jm2-qr9m-f9rjCGA-3w82-3rmg-254jCGA-4q96-hxmw-53gwCGA-4v7v-44p5-vwqcCGA-54vx-3hc4-v73fCGA-575m-v7pp-vmjmCGA-5c4m-49mx-8rf9CGA-5fhm-4fwm-q9qxCGA-5hrj-2ghj-c6hqCGA-5m8m-cvf5-pfqfCGA-62hj-27xw-6p3jCGA-64fm-q2cw-45g8CGA-738v-r7hg-3p3cCGA-73x7-q54w-hw3qCGA-78fc-vqw2-gr5mCGA-79xf-wvfc-hxw7CGA-7cgr-8328-2gwrCGA-7wrh-2wvm-87gwCGA-8335-q57g-pcxrCGA-83j8-8cxv-7fhrCGA-8j9q-59pr-5qr8CGA-8mfg-fgcq-49q7CGA-9537-r87c-gjf9CGA-9wjq-cvhp-2hwgCGA-f596-2r62-5qgrCGA-f8cc-39p9-37jqCGA-fg6h-w47x-xp56CGA-fhrj-5w6g-h244CGA-fp3j-g6hv-j92hCGA-fv3q-wrph-pvhwCGA-fxvf-xgff-qmx9CGA-g65h-pph4-ph6pCGA-gm3q-g53f-fgc5CGA-gp6j-678v-wv6mCGA-h33w-r6wc-q2ffCGA-hwmq-jfw9-v7qcCGA-j4j2-62v2-c3mrCGA-j76c-wm9r-qq2rCGA-jmwj-x7rw-v3gwCGA-mgwf-7fx2-7583CGA-mj47-pwgg-63rcCGA-mm64-q2p8-5498CGA-mw78-wcqp-6g8xCGA-p5q6-6hcg-x8fhCGA-p73r-xh2c-5x78CGA-p9c7-p332-qvc2CGA-pgf6-hxhm-3c5cCGA-qgfv-c6pr-rc4qCGA-qhpm-674x-95vvCGA-qp52-5fwc-9qf5CGA-r6gc-v33f-2j68CGA-rpqq-5837-886cCGA-rv3m-vc6h-3mh5CGA-v9g6-x5jq-v4jpCGA-vgrq-4634-cr8rCGA-vm7j-p75q-9mjrCGA-vrgv-738r-fg3pCGA-w7fm-h959-r36jCGA-w7xh-w84q-43f8CGA-w99f-526c-qx9xCGA-wpw9-88c8-3p3hCGA-wr82-h749-6gpfCGA-wxxx-ph7v-vwjcCGA-xp6f-3287-vgrjCGA-xqr7-qcq9-7qxmCGA-xv22-gmj7-22rwCGA-xxm5-4cp9-q8c7CGA-6fhj-ccpc-w8vpCGA-6q6m-xxcp-vqq5CGA-7fj8-44r6-8vrjCGA-cwm6-wfvf-vhvq
Published 15-10-2024Last modified 15-10-2024
Vulnerability summary
CVE-2024-9506 is a low (CVSS 3.7) vulnerability in vue. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.5% of scored vulnerabilities.
CVSS score
3.7/10
010
Low · v3.1 (CVE.org)EPSS score
0.53%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 15-10-2024PublishedVulnerability first disclosed.
- 15-10-2024Last modifiedVulnerability information updated.
Description
Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
CVSS metrics
8 scores · 5 sources · 2 versionsMedium 6.3Preferred score · OSV · Wolfi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PSourcesAll 3 agree
- OSV · NpmEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Low 3.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · NpmEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
0.00 pp
From 0.53% on 20-09-2026
20-09-202620-10-2026
EPSS score0.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard41 products
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
- commercial-gitlab-rails-ee-19.3< 19.3.3-r1
- commercial-gitlab-rails-ee-19.4< 19.4.1-r1
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
Wolfi2 products
- nextcloud-server-32All versions (No fix recorded)
- nextcloud-server-33All versions (No fix recorded)
Npm1 product
- vue≥ 2.0.0-alpha.1, < 3.0.0-alpha.0
Vue1 product
- vue≥ 2.0.0, ≤ 2.7.16
4 vendors · 45 products
References
3 links
- github.com/vuejs/corePACKAGE