// XSS Injection
Vue.createApp({
  template: `<div>` + userProvidedString + `</div>`
}).mount('#app')

<div v-html="userProvidedHtml"></div>

h('div', { innerHTML: this.userProvidedHtml })

<div innerHTML={this.userProvidedHtml}></div>

// Javascript protocol injection
<a :href="userProvidedUrl">click me</a>

// CSS Injection
<h1 :style="userProvidedStyles">Title</h1>