Check how it renders HTML, what it pulls in, whether anyone maintains it and how you will keep it updated. A UI component runs with your page's full privileges, so a risky sink in it becomes your XSS. A short review before you install is cheap.
Why components deserve scrutiny
The Vue security guide advises reviewing the source code of dependencies for potentially dangerous patterns, especially third-party components or anything that influences what is rendered to the DOM. OWASP lists out of date framework plugins or components as one way frameworks end up used insecurely. A date picker or rich text widget can contain exactly the escape hatches you carefully avoid in your own code.
The review routine
- Need. Do you need a package, or ten lines of your own code? Fewer dependencies mean a smaller surface.
- Sinks. Search its source for dangerouslySetInnerHTML, v-html, innerHTML, insertAdjacentHTML, bypass calls and eval. Note which props feed them.
- Props that take HTML. If a prop accepts a string that is later rendered as markup, you must sanitize anything you pass. Read the docs for a safe mode.
- Dependencies. List its direct and transitive dependencies. A small component with a deep tree is not small.
- Install scripts. Check whether any package in the tree runs install scripts. See which npm lifecycle scripts run when you install.
- Maintenance. Look at the last release, open security issues, and whether a security contact or policy exists.
- Version fit. Confirm it supports the framework version you run, and your upgrade path.
- Alternatives. Compare at least two options on the points above.
Scoring sheet
| Check | Good sign | Warning sign |
|---|---|---|
| HTML sinks | None, or documented sanitized mode | Raw HTML props with no guidance |
| Dependency tree | Small and shallow | Large tree for a small job |
| Maintenance | Recent releases, security policy | Long silence, unanswered issues |
| Scope | Does one job | Brings an entire framework |
| Updates | Semantic versioning, changelog | Breaking changes with no notes |
After you add it
Pin it with a lockfile and use a frozen install in CI. Put it in your inventory with an owner. Watch advisories for it, and keep a short update cycle. Test the upgrade path now, not on the day an advisory lands.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one added component expands into direct and transitive packages.
Safeguard's dependency scanning and reachability analysis show known issues in a component's tree and whether the vulnerable code is called. You can try the free scan at gold.safeguard.sh/scan.
Quick check
Is a popular component automatically safe?
No. Popularity helps you find fixes and reports, but you still need to review sinks, dependencies and update habits.
How long should a review take?
For most components, a quick pass through the checks above takes minutes. Spend more on components that handle HTML, files or authentication.
Sources
Last reviewed: 19 October 2026.
