nuxt
diff --git a/Collapse file
‎docs/4.api/6.nuxt-config.md‎
Copy file name to clipboardExpand all lines: docs/4.api/6.nuxt-config.md
+6Lines changed: 6 additions & 0 deletions
Display the source diff
Display the rich diff b/Collapse file
‎docs/4.api/6.nuxt-config.md‎
Copy file name to clipboardExpand all lines: docs/4.api/6.nuxt-config.md
+6Lines changed: 6 additions & 0 deletions
Display the source diff
Display the rich diff
diff --git a/Collapse file
‎packages/schema/src/types/schema.ts‎
Copy file name to clipboardExpand all lines: packages/schema/src/types/schema.ts
+9Lines changed: 9 additions & 0 deletions b/Collapse file
‎packages/schema/src/types/schema.ts‎
Copy file name to clipboardExpand all lines: packages/schema/src/types/schema.ts
+9Lines changed: 9 additions & 0 deletions
@@ -1896,9 +1896,15 @@ Enable reactive destructure for `defineProps`
 
 Include Vue compiler in runtime bundle.
 
+Enabling this allows components to compile templates at runtime (for example, string `template` options or templates supplied via data).
+
 - **Type**: `boolean`
 - **Default:** `false`
 
+::warning
+Runtime template compilation executes the compiled template as JavaScript. Never compile templates built from user-provided or otherwise untrusted input; doing so is equivalent to `eval` and can lead to cross-site scripting or remote code execution. See the [Vue security guide](https://vuejs.org/guide/best-practices/security.html).
+::
+
 ### `transformAssetUrls`
 
 #### `image`
 
@@ -109,6 +109,15 @@ export interface ConfigSchema {
 
     /**
      * Include Vue compiler in runtime bundle.
+     *
+     * Enabling this allows components to compile templates at runtime (for example,
+     * string `template` options or templates supplied via data).
+     *
+     * Runtime-compiled templates can execute arbitrary JavaScript. Never pass
+     * user-provided or otherwise untrusted content to a runtime-compiled template;
+     * treat any string that reaches the compiler as executable code.
+     *
+     * @see [Vue security guide](https://vuejs.org/guide/best-practices/security.html)
      */
     runtimeCompiler: boolean