Description

This detector identifies client-side template injection vulnerabilities in TypeScript Vue.js applications. Template injection occurs when user input is directly embedded into Vue templates without proper sanitization, allowing attackers to execute arbitrary JavaScript code or access sensitive application data through template expressions.

Detection Strategy

• Scans TypeScript files that contain Vue.js template syntax or component definitions

• Identifies locations where user-controlled data flows into Vue template constructors

• Reports vulnerabilities when unsanitized external input is used directly in template interpolation

• Flags risky patterns such as direct property binding from user input, unsafe use of template literals in Vue templates, or bypassing Vue's built-in XSS protections

Vulnerable code example

import Vue from "vue";
import { createApp } from "vue";

// User input directly used as Vue template
const userInput = prompt("Enter template");

// VULNERABLE: User-controlled content compiled as Vue template - enables XSS
createApp({...

✅ Secure code example

import Vue from "vue";
import { createApp } from "vue";

// SAFE: Render function prevents template compilation
const userInput = prompt("Enter content");
createApp({
  render() {
    // SAFE: User input used as text content, not executable template...