Vue 3.5

Apply the JavaScript ES2026 baseline first. These rules cover Vue 3.5.

Templates and HTML output

• Keep template source fully trusted: Vue compiles templates to JavaScript, so request-, CMS-, translation-, or tenant-supplied templates are code execution and can breach the SSR host.
• With a compiler-enabled build and no root render or template, mount createApp() only on trusted markup; Vue compiles the container's existing HTML, including server-rendered user content.
• Render untrusted values with text interpolation or v-text so Vue escapes them.
• Avoid v-html, which sets innerHTML; sanitize rich HTML with a maintained allowlist sanitizer immediately before binding, and never use it to compose templates.
• Never concatenate fragments after sanitizing or compile user-authored templates in the application origin.
• Keep untrusted values out of inline scripts, styles, event handlers, raw SVG, and other executable contexts.

Attributes, URLs, and components

• Sanitize user URLs on the backend before persistence, then enforce destination-specific scheme/host/path allowlists before :href, :src, form, iframe, or resource bindings; attribute escaping doesn't block javascript:.
• Never v-bind="object" untrusted objects onto DOM elements or privileged components. In SSR the object's keys become HTML attribute names, so build bound objects from attribute names fixed in code, never request, CMS, or user keys.
• Map dynamic component names through an exact trusted registry, never arbitrary names or import paths.
• Register directives, global properties,