PT-2024-39667 · Vue · Vue

K · Published 2024-10-15 · Updated 2026-01-24 · CVE-2024-9506

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Vue (affected versions not specified)

Description The issue is related to an improper regular expression in Vue's parseHTML function, which can lead to a potential regular expression denial of service vulnerability. This flaw, known as a ReDoS (Regular expression Denial of Service), allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption. In a Vue client-side application, this vulnerability can be exploited by creating a new Vue instance with a template string that includes a <script> tag but closes it incorrectly. The time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.

Recommendations To mitigate this issue, consider disabling the parseHTML function in the html-parser.ts file until a patch is available. Restrict access to the html-parser.ts file to minimize the risk of exploitation. Avoid using the parseHTML function with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-9506

GHSA-5J4C-8P2G-V4JX

Affected Products

Vue

References · 7

• https://osv.dev/vulnerability/GHSA-5j4c-8p2g-v4jx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9506 · Security Note
• https://github.com/vuejs/core · Note
• https://t.me/cvedetector/7928 · Telegram Post
• https://herodevs.com/vulnerability-directory/cve-2024-9506 · Note
• https://twitter.com/CVEnew/status/1846217371226460177 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846283571067039978 · Twitter Post