Versions of buefy prior to 0.7.2 are vulnerable to Cross-Site Scripting, allowing attackers to manipulate the DOM and execute remote code. The autocomplete list renders user input as HTML without encoding.

Recommendation

Upgrade to version 0.7.2 or later.

References

• buefy/buefy#1097
• https://www.npmjs.com/advisories/747