title: Does Vue, by default, provide security for or protects against XSS?
body: <p>I am trying to figure out how to protect,</p>
  
  <ul>
  <li>Angular</li>
  <li>Vue</li>
  <li>React</li>
  </ul>
  
  <p>against XSS attacks. When I visit the Angular official docs,</p>
  
  <p><a href="https://angular.io/guide/security" rel="noreferrer">https://angular.io/guide/security</a></p>
  
  <p>, it says:</p>
  
  <blockquote>
    <p>To systematically block XSS bugs, Angular treats all values as
    untrusted by default. When a value is inserted into the DOM from a
    template, via property, attribute, style, class binding, or
    interpolation, Angular sanitizes and escapes untrusted values.</p>
  </blockquote>
  
  <p>and also:</p>
  
  <blockquote>
    <p>Angular sanitizes untrusted values for HTML, styles, and URLs;
    sanitizing resource URLs isn't possible because they contain arbitrary
    code. In development mode, Angular prints a console warning when it
    has to change a value during sanitization.</p>
  </blockquote>
  
  <p>and:</p>
  
  <blockquote>
    <p>Angular recognizes the value as unsafe and automatically sanitizes it,
    which removes the  tag but keeps safe content such as the 
    element.</p>
  </blockquote>
  
  <p>When I go to the React official docs,</p>
  
  <p><a href="https://reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-attacks" rel="noreferrer">https://reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-attacks</a></p>
  
  <p>,it says the following:</p>
  
  <blockquote>
    <p>It is safe to embed user input in JSX:</p>
  </blockquote>
  
  <p>and:</p>
  
  <blockquote>
    <p>By default, React DOM escapes any values embedded in JSX before
    rendering them. Thus it ensures that you can never inject anything
    that’s not explicitly written in your application. Everything is
    converted to a string before being rendered. This helps prevent XSS
    (cross-site-scripting) attacks.</p>
  </blockquote>
  
  <p>But for Vue, I cannot find anything in their docs about XSS protection, or anything that they could provide by default. </p>
  
  <p><strong>My question:</strong> Does Vue, by default, deliver any way of protection against XSS attacks, or would I need to look for a 3rd party solution?</p>
  
  <p>When I Google for this subject I get a lot of blog posts sites and articles refering to, for example, this project to sanitize my HTML:</p>
  
  <p><a href="https://github.com/punkave/sanitize-html" rel="noreferrer">https://github.com/punkave/sanitize-html</a></p>