Registry /
web-framework / vue-template-compiler-patched
Install & Compatibility
Where this runs
No compatibility data collected yet for this library.
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
compile
✓ const compiler = require('vue-template-compiler-patched'); const { render } = compiler.compile(template);
✗ import { compile } from 'vue-template-compiler-patched' (no named export at root)
Main export is the compiler object, not named 'compile'. Use default require or default import.
default (compiler object)
✓ import compiler from 'vue-template-compiler-patched'; compiler.compile(template);
✗ import { compile } from 'vue-template-compiler-patched'
ESM default import works. Named imports like 'compile' are not available at top level.
compile (via destructuring)
✓ const { compile } = require('vue-template-compiler-patched');
✗ const compile = require('vue-template-compiler-patched').compile (incorrect, no named export)
Destructuring works only in CommonJS require, not ESM named imports.
ssrCompile
✓ const { ssrCompile } = require('vue-template-compiler-patched');
✗ import { ssrCompile } from 'vue-template-compiler-patched'; // errors if module is CJS only
Same rules as compile; available via destructuring in CJS or as property of default export in ESM.
parseComponent
✓ import { parseComponent } from 'vue-template-compiler-patched';
✗ const parseComponent = require('vue-template-compiler-patched').parseComponent; // works but ugly
This IS a named export (not on default object). Use named import in ESM.
Shows how to require the patched compiler, compile a template, use SSR compiler, and parse a single-file component.
const compiler = require('vue-template-compiler-patched');
const template = '<div>{{ message }}</div>';
const result = compiler.compile(template, { outputSourceRange: true });
console.log(result.render);
// with: function anonymous() { with(this) { ... } }
// SSR example:
const { ssrCompile } = compiler;
const ssrResult = ssrCompile(template);
console.log(ssrResult.render);
// Parse SFC:
const { parseComponent } = require('vue-template-compiler-patched');
const sfc = `<template><div>Hello</div></template>`;
const parsed = parseComponent(sfc);
console.log(parsed.template.content);
Debug
Known issues
breakingOutput of compile() may differ from original due to XSS sanitization (CVE-2024-6783) - dynamic attributes containing user input are encoded. This may break existing templates relying on raw HTML injection via v-html or mustache without escaping.fixUse v-html with trusted content only; or manually bypass sanitization with v-pre or skip compilation.
affects: >=2.7.16-patch.1
breakingReDoS fix (CVE-2024-9506) changes regex balancing in tag parsing. Very long or malformed templates may now fail to compile instead of hanging the process.fixSimplify overly complex templates; validation errors now surface earlier.
affects: >=2.7.16-patch.2
deprecatedThe alias install method (npm:vue-template-compiler-patched) is recommended over direct require of patched name to avoid peer dependency conflicts.fixInstall as vue-template-compiler@npm:vue-template-compiler-patched@^2.7.16-patch.2
affects: all
gotchaThe compile() output still uses 'with' statement, so it cannot be used in strict mode ('use strict') environments without eval-like workarounds.fixWrap render functions in a non-strict scope, or use 'new Function(renderCode)' with appropriate context.
affects: all
gotchaESM named imports like 'compile' are NOT available; you must use default import or require with destructuring. parseComponent IS a named export.fixUse: import compiler from 'vue-template-compiler-patched'; then compiler.compile(...).
affects: all
Errors
Common errors & fixes
Cannot find module 'vue-template-compiler'
You installed vue-template-compiler-patched but the code (e.g., @vue/test-utils) requires 'vue-template-compiler' directly.
fixInstall via the alias method: npm vue-template-compiler@npm:vue-template-compiler-patched@^2.7.16-patch.2 --save-dev
Failed to compile template: Template syntax error: Unexpected token in attribute expression
New stricter parsing due to ReDoS fix; a very long or malformed attribute value now errors instead of hanging.
fixShorten or escape problematic template content; avoid deeply nested or unbalanced quotes.
TypeError: compiler.compile is not a function
ESM import incorrectly uses named import: import { compile } from 'vue-template-compiler-patched'.
fixUse default import: import compiler from 'vue-template-compiler-patched'; then compiler.compile().
Uncaught ReferenceError: this is not defined (in render function)
Compiled render function uses 'with(this)' but strict mode is enabled.
fixCreate context with { Vue: ..., ... } and pass to render.call(context). Module not found: Error: Can't resolve 'vue-template-compiler-patched' in '/path'
Package is not installed or webpack alias is misconfigured.
fixInstall correctly: npm i vue-template-compiler-patched --save-dev; or configure alias to point to patched version.
Upgrade
Version history
2.7.16-patch.2latest on npm
Audit
Dependencies
vueoptionalPeer dependency for compiler output compatibility; same version range as original vue-template-compiler requires.