---
title: "Vue. Potential XSS In SSR When Using v-bind On Versions Under 2.5.17"
description: "**Impact area** Security **Severity** Medium **Affected element** **ServiceNow** UI Script **Salesforce** Static Resource Rule number **SN-JSL-VUE-LESSTHAN-V2517 **(for ServiceNow) **SF-JSL-VUE-LESSTHAN-V2517 **(for Salesforce) ## Impact  Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when spread attributes in the ssr files are…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/vue-potential-xss-in-ssr-when-using-v-bind-on-versions-under-2-5-17-2/"
updated: "2025-03-21"
category: Rules
---

# Vue. Potential XSS In SSR When Using v-bind On Versions Under 2.5.17

**Impact area**

Security

**Severity**

Medium

**Affected element**

**ServiceNow**

UI Script

**Salesforce**

Static Resource

Rule number

**SN-JSL-VUE-LESSTHAN-V2517 **(for ServiceNow)

**SF-JSL-VUE-LESSTHAN-V2517 **(for Salesforce)

## Impact

 Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when spread attributes in the ssr files are unsanitized and can therefore be attack vectors for untrusted user input.

Remediation

Update vue JS library to the latest version.

**Time to fix**

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').](https://cwe.mitre.org/data/definitions/79.html)