@farming-labs/nuxt-theme@0.2.126
Nuxt/Vue UI components for @farming-labs/docs — layout, sidebar, TOC, search, and theme toggle
AI Security Review
scanned 13d ago · by lpm-firewall-aiStatic source confirms an HTML injection vulnerability in the exported AI chat component. The renderer’s unsanitized output reaches v-html for user and API response messages, so this warrants a warning for a critical vulnerability.
Static reason
No blocking static signals were detected.
Trigger
A user submits a chat question, or the configured chat API returns message content containing HTML or unsafe Markdown.
Impact
An injected message can run script in the site origin and act with the visitor’s browser privileges.
Mechanism
FloatingAIChat passes user and streamed assistant messages to renderMarkdown and inserts the result with v-html; the renderer interpolates message text and link values into HTML without escaping them.
AI rationale
Static source confirms an HTML injection vulnerability in the exported AI chat component. The renderer’s unsanitized output reaches v-html for user and API response messages, so this warrants a warning for a critical vulnerability.
Evidence
src/components/FloatingAIChat.vuesrc/lib/renderMarkdown.jssrc/index.js
Network endpoints1
/api/docs
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The package exports FloatingAIChat as part of its public entrypoint.
- When a user submits a question, the component sends it to props.api and keeps the prompt in the displayed messages.
- The component also adds streamed API response content to messages; both chat layouts render message content using v-html with renderMarkdown.
- The renderer inserts Markdown text and link values into HTML without escaping or sanitizing the input.
- The renderer defines an HTML escaping helper, but the shown Markdown replacements do not apply it to message text or link values.
Evidence against
Behavioral surface
HighEntropyStringsPossibleObfuscation
Source & flagged code
8 flaggedsrc/components/ApiReferenceSwitcher.vueView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/components/ApiReferenceSwitcher.vueView on unpkgsrc/index.jsView file
7export { default as DocsLayout } from "./components/DocsLayout.vue";
export { default as DocsContent } from "./components/DocsContent.vue";
export { default as DocsPage } from "./components/DocsPage.vue";
export { default as TableOfContents } from "./components/TableOfContents.vue";
export { default as Breadcrumb } from "./components/Breadcrumb.vue";
export { default as SearchDialog } from "./components/SearchDialog.vue";
export { default as FloatingAIChat } from "./components/FloatingAIChat.vue";
export { default
Medium
Ai Review Evidence
The package exports FloatingAIChat as part of its public entrypoint.
src/index.jsView on unpkg · L7Findings
1 High7 Medium2 Low
HighSemantic Analysis Limitedsrc/components/ApiReferenceSwitcher.vue
MediumAi Review Evidencesrc/index.js
MediumAi Review Evidencesrc/components/FloatingAIChat.vue
MediumAi Review Evidencesrc/components/FloatingAIChat.vue
MediumAi Review Evidencesrc/components/FloatingAIChat.vue
MediumAi Review Evidencesrc/components/FloatingAIChat.vue
MediumAi Review Evidencesrc/lib/renderMarkdown.js
MediumAi Review Evidencesrc/lib/renderMarkdown.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @farming-labs/nuxt-theme@0.2.126.
See all versions of @farming-labs/nuxt-theme for other recorded verdicts.
- Review the evidence and your use of @farming-labs/nuxt-theme@0.2.126 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.