@vue/server-renderer: XSS via missing CR in attribute-name blacklist
@vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body – a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already running the app's own JS. ssrRenderAttrs() (in packages/server-renderer/src/helpers/ssrRenderAttrs.ts) is what compiled SSR output calls for something like <div v-bind="userObject">. It loops over the object's own keys and, for each one, …