flawopen.com/XSS in JavaScript/Vue v-html

Is Vue's v-html safe to use?

Reference page — draft, pending review
Short answer

Only if the HTML string is sanitized immediately before use. Vue's default {{ }} interpolation escapes automatically — v-html is the explicit, named way to opt out of that.

RISKY — the escape hatch
<p v-html="comment"></p>
// comment is parsed as real markup
SAFE — default interpolation
<p>{{ comment }}</p>
// escaped automatically

Doing it correctly

Sanitize with a maintained library like DOMPurify immediately before binding to v-html — never sanitize once at input time and trust it forever, since the sanitizer's rules and the threat landscape both evolve.

How to check your codebase

grep -rn "v-html" --include="*.vue" .

FAQ

Is this the same risk as React's dangerouslySetInnerHTML?

Yes — same mechanism, same rule, different framework naming.

References