Nuxt CVE-2026-114130

Requires a specific non-default deployment: the Nuxt application must run with pages disabled (no-pages router mode), and the application must bind attacker-controlled input to a NuxtLink 'to' prop (or default anchor/custom output). The malicious value must be an ASCII C0 control character prefixing a script-capable scheme (e.g., javascript:), which the no-pages router classifies as an internal route before the protocol check. Exploitation is LIMITED by: mandatory user interaction (the victim must click the rendered link, matching UI:P), the need for the application to reflect untrusted data into the link target, and the pages-disabled configuration requirement. Affects Nuxt versions prior to 4.6.0; fixed in 4.6.0.

This is a genuinely low-priority issue despite the network attack vector. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N, score 2.3) shows exploitation hinges on two de-prioritizing factors: AT:P (a specific attack requirement - the app must run with pages disabled AND reflect attacker input into NuxtLink's 'to') and UI:P (the victim must actively click the crafted link). No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified in the input, so all exploitation-likelihood signals are either absent or point to low real-world risk. Impact is limited (VC:L/VI:L, VA:N) - reflected script execution in the app origin, not full compromise. Note a modeling discrepancy: a CVSS 3.1 reflected-XSS vector typically scores higher (~6.1) because 3.1 collapses the AT:P/UI:P nuance into coarser AC/UI metrics and credits a scope change; the 4.0 2.3 rating better captures the restrictive preconditions. Net assessment: a real but narrowly-conditioned client-side XSS that is a patch-on-schedule item, not an emergency - more likely to matter for targeted attacks against specific misconfigured deployments than for widespread opportunistic exploitation.

A Nuxt application configured with pages disabled renders a NuxtLink whose 'to' value is derived from attacker-controlled input (e.g., a query parameter or stored field). The attacker supplies a value consisting of an ASCII C0 control character followed by a javascript: URL; the no-pages router misclassifies it as an internal route and emits it as an anchor href in the server-rendered HTML. When a victim clicks the link, the browser strips the leading control character and executes the remaining javascript: URL in the application's origin. No public exploit was identified at time of analysis.