diff --git a/src/index.js b/src/index.js index 9892d218..a38332ac 100644 --- a/src/index.js +++ b/src/index.js @@ -209,6 +209,9 @@ function _renderToString(vnode, context, isSvgMode, selectValue, parent) { } return rendered; } + + // VNodes have {constructor:undefined} to prevent JSON injection: + if (vnode.constructor !== undefined) return ''; vnode[PARENT] = parent; if (options[DIFF]) options[DIFF](vnode);