Is there a public PoC exploit available for CVE-2026-53722?

Yes, a public proof-of-concept exploit is available for CVE-2026-53722. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-53722?

Yes, a patch is available for CVE-2026-53722. Update the affected software to the latest version immediately.

Nuxt CVE-2026-53722

Q: What is the CVSS score of CVE-2026-53722?

CVE-2026-53722 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-36428 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-12 GitHub_M

GHSA-934w-87qh-qr26

XSS Nuxt

5.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered XSS with no privileges required; S:C because script executes in the application's browser origin; UI:R for required victim click.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 16:01 EUVD

Source Code Evidence Fetched

Jun 12, 2026 - 14:55 vuln.today

Analysis Generated

Jun 12, 2026 - 14:55 vuln.today

DescriptionCVE.org

Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <NuxtLink> did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying <a> element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to <NuxtLink :to> or :href, the attacker can supply a javascript: or vbscript: URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt application, resulting in reflected DOM-based cross-site scripting. A data:text/html,... payload reflected through the same sink does not execute in the application's origin but enables a same-tab phishing surface anchored to a legitimate application link. The same value was exposed to consumers of the component's custom slot via the href and route.href props, so applications that re-bind those values to their own anchors were affected identically. This issue has been patched in versions 3.21.7 and 4.4.7.

AnalysisAI

Reflected DOM-based XSS in Nuxt's built-in <NuxtLink> component allows an unauthenticated attacker to inject script-capable URLs (javascript:, vbscript:) that execute in the application's origin when a victim clicks a crafted link, affecting all Nuxt v3 versions prior to 3.21.7 and v4 versions prior to 4.4.7. Exploitation is contingent on application code that binds attacker-controlled input - such as query parameters, CMS link fields, or user-supplied profile URLs - directly to the component's to or href props without prior sanitization. No public exploit code has been identified and the EPSS score of 0.06% (20th percentile) indicates low observed exploitation probability; vendor-released patches are available in versions 3.21.7 and 4.4.7.

Technical ContextAI

The vulnerability resides in packages/nuxt/src/app/components/nuxt-link.ts, Nuxt's routing anchor component that wraps Vue Router's useLink composable. Prior to the fix, any value passed to the to or href prop was reflected verbatim into the rendered <a> element's href attribute without protocol validation, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). Browsers interpret javascript: and vbscript: URLs as executable scripts when activated, making any unsanitized href sink a potential XSS vector. A secondary data:text/html payload does not execute in the application's origin but enables a same-tab phishing surface anchored to a legitimate URL. The custom slot mechanism also exposed the raw href and route.href values to slot consumers, meaning applications that re-bound those props to their own anchor elements were identically vulnerable. The fix, delegating scheme validation to ufo's isScriptProtocol helper, introduces sanitizeExternalHref() which strips ASCII whitespace and control characters (exploited by parsers tolerating them before the scheme), recursively peels view-source: prefixes (transparently resolved by Chromium), and rejects javascript:, data:, vbscript:, and blob: schemes by returning null. The affected CPE is cpe:2.3:a:nuxt:nuxt:* covering all pre-patch releases.

RemediationAI

The primary remediation is to upgrade to Nuxt 3.21.7 (v3 branch) or 4.4.7 (v4 branch), both of which include the sanitizeExternalHref() fix confirmed by patch commits at https://github.com/nuxt/nuxt/commit/0103ce06fbbbdfa079a7f020ef8ce00121eac4a3 and https://github.com/nuxt/nuxt/commit/53284043dc21210a25d629d1cec67d3ae557ffd0. If immediate upgrade is not feasible, applications should implement server-side or data-layer URL validation before binding any external input to <NuxtLink> props: specifically, allow only known-safe schemes (https:, http:, mailto:, tel:) via an explicit allowlist, rejecting all others prior to rendering - placing this check in the data pipeline rather than in the template avoids reliance on client-side component behavior. Additionally, deploying a strict Content Security Policy header (script-src 'self' with no unsafe-inline) will reduce exploitability of any residual XSS sinks, though CSP alone will not prevent DOM-based injection or the data: phishing vector. Custom slot consumers that re-bind the href or route.href slot props to their own anchor elements must apply the same input sanitization.