It took me a minute to understand why this is happening, but it comes down to this: everything is escaped properly, but the Vue.js component is defined _in the

It took me a minute to understand why this is happening, but it comes down to this: everything is escaped properly, but the Vue.js component is defined _in the HTML_. By injecting anything at all inside the component's markup, you're modifying the component's source code rather than modifying inputs to it. Even if you're using a perfectly well-built HTML escape function, the user can then write code that gets parsed and executed because it's part of the component's source template. Edit: A better approach here would have been to compile the component into a JS file and load it separately from the page itself, then pulling user input from a global variable or data attribute somewhere in the page. The same attack could conceivably be carried out on React if you're building your components inline (albeit sans-JSX) and injecting user input into the raw <script> source.