Use interpolation expressions instead of the v-html attribute JS-0693

It is recommended to use interpolation expressions instead of using v-html as it prevents injection attacks like XSS.

Injecting HTML is a feature available to any front-end framework and used by websites when the server renders HTML. Using interpolation expressions is recommended as expression here gets stringified instead of getting executed, unlike in v-html

Bad Practice

<div v-html="someHTML"></div>

Recommended

<div>{{ someHTML }}</div>

References

• OWASP A03:2021 - Injection
• OWASP Cross Site Scripting (XSS)
• XSS in VUE
• Security notes for VUE