vuejs/vue
This is the repo for Vue 2. For Vue 3, go to https://github.com/vuejs/core
How vue is put together
This is the archived Vue.js 2.7 repository (End of Life as of Dec 31, 2023), a progressive JavaScript framework for building user interfaces, written primarily in TypeScript. It is a pnpm workspace monorepo producing the core 'vue' runtime plus three sub-packages: @vue/compiler-sfc (single-file-component compilation), vue-server-renderer (SSR), and vue-template-compiler. Data flow follows the classic Vue 2 pipeline: templates or render functions are compiled into render functions by src/compiler, components are instantiated and made reactive by the observer system in src/core/observer, virtual DOM trees are created and patched by src/core/vdom, and the server-renderer package mirrors this pipeline for string/stream output on Node.
Languages
Frameworks
Infrastructure
Major components
Template compiler (src/compiler)
Parses HTML templates (html-parser, entity-decoder, text/filter parsers), runs an optimizer, and generates render-function code (codegen) including directive handling for bind/model/on.
Core runtime (src/core)
Implements the reactive observer system (dep/watcher/scheduler/array observers), component instance lifecycle (init, state, events, inject, proxy, render), global API (extend/mixin/use/assets), built-in keep-alive, and the virtual DOM patcher.
v3 Composition API backport (src/v3)
Backports Vue 3 APIs into Vue 2.7: setup(), ref/reactive/computed/effect reactivity, watch, provide/inject, lifecycle hooks, h(), async components, effectScope, and SFC helpers like useCssModule/useCssVars.
Web platform entries (src/platforms/web)
Defines the distribution entry points (runtime-only, runtime-with-compiler, ESM variants) that wire the core runtime to the full compiler for browser targets.
@vue/compiler-sfc (packages/compiler-sfc)
Parses .vue single-file components (parseComponent), compiles <script setup> via Babel AST transforms (compileScript, prefixIdentifiers, rewriteDefault), compiles styles with preprocessors and scoped-CSS plugins, and handles asset URLs/srcsets.
vue-server-renderer (packages/server-renderer)
Renders Vue apps to strings or streams on the server, including an optimizing SSR compiler, template rendering with async file mapping, bundle renderer/runner for webpack-built apps, and client/server webpack plugins.
vue-template-compiler (packages/template-compiler)
Standalone npm package exposing the template compiler separately from the runtime so build tools can precompile templates.
Type definitions (types/, src/types)
Hand-maintained public typings for the Vue constructor, options, VNodes, JSX, and generated/backported v3-style typing surfaces consumed via api-extractor.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
7 vulnerable packages (10 advisories) across 42 scanned dependencies.
vitest 1.0.4
2 advisories. Fixed in 4.1.0.
How it can be abusedIf a developer runs the test suite with the Vitest UI or API server turned on, an attacker could get them to visit a malicious website that then reads files on their machine or runs code as them. This affects anyone contributing to or testing this repo locally who leaves those servers listening.
- criticalGHSA-5xrq-8626-4rwpWhen Vitest UI server is listening, arbitrary file can be read and executed
- criticalGHSA-9crc-q9x8-hgqqVitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
cross-spawn 7.0.3
1 advisory. Fixed in 7.0.5.
How it can be abusedThis package helps run shell commands and can hang forever if given certain long or oddly formatted command strings. An attacker would need to control the arguments passed to those commands, which here only happens during local builds on developer machines, so end users of Vue apps are not affected.
- highGHSA-3xgq-45jj-v275Regular Expression Denial of Service (ReDoS) in cross-spawn
lodash 4.17.21
1 advisory. Fixed in 4.18.0.
How it can be abusedAn attacker who can control text passed to lodash's template function could sneak in code that runs on your server or in a user's browser. In this repo lodash is only a development tool and the installed version already contains the fix, so real users of Vue are not affected.
- highGHSA-r5fr-rjxr-66jclodash vulnerable to Code Injection via `_.template` imports key names
postcss 8.4.14
2 advisories. Fixed in 8.5.12.
How it can be abusedIf a build step processed CSS from an untrusted source, PostCSS could be tricked by a fake sourceMappingURL comment into reading and exposing arbitrary .map or other files from the developer's machine or server. Here PostCSS only handles the project's own trusted style files during builds, so only developers running builds on hostile third-party CSS would be affected.
- highGHSA-6g55-p6wh-862qPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
- highGHSA-r28c-9q8g-f849PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
rollup 2.79.1
2 advisories. Fixed in 3.29.5.
How it can be abusedAn attacker who can add HTML to a page that loads one of Vue's prebuilt browser bundles could name an HTML element to trick the bundled script into reading attacker-controlled data as if it were trusted code, potentially running their JavaScript in visitors' browsers. This only matters for sites serving these built bundles and only if the attacker can already inject markup into those pages.
- highGHSA-gcx4-mw62-g8wmDOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
- highGHSA-mw96-cpmx-2vgcRollup 4 has Arbitrary File Write via Path Traversal
semver 7.3.7
1 advisory. Fixed in 7.5.2.
How it can be abusedAn attacker could send a crafted version string that makes the regex inside semver hang and burn CPU, freezing whatever process parses it. In this repo semver is only used in build scripts and dev tooling on trusted inputs, so real users of Vue are not affected.
- highGHSA-c2qf-rxjj-qqgwsemver vulnerable to Regular Expression Denial of Service
terser 5.14.0
1 advisory. Fixed in 4.8.1.
How it can be abusedAn attacker who can get malicious JavaScript into your build, such as through a compromised dependency or user-supplied code that gets minified, could craft input that makes Terser's regexes hang and freeze the build or server doing the minification. This mainly affects developers and CI machines running builds on untrusted code, not end users of the published Vue packages.
- highGHSA-4wf5-vphf-c2xcTerser insecure use of regular expressions leads to ReDoS
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required