Clarification #2
Description
Hello, I know this is relatively old, but this repo is being used by some "security researchers" as an evidence of Vue being "insecure" when the vulnerability itself actually isn't a Vue-induced problem.
For the injection to work, this repro is directly inlining unsanitized user input in raw HTML. This practice itself already allows any attacker to inject anything they want without any JavaScript framework being involved. Since the HTML will be evaluated before Vue even gets to process it, the vulnerability is fundamentally caused by the practice of rendering unsanitized HTML (which any competent dev should know to avoid), not by using Vue.
Vue docs also explicitly discourages users from doing this - related info: https://vuejs.org/guide/best-practices/security.html#rule-no-1-never-use-non-trusted-templates
This repo can still serve as an example of what not to do - but please include the above clarification in the README.