EUVD-2026-38112
GHSA-xppm-jmw6-fhmf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires application code to pass attacker-controlled input into a NoScript slot; S:C because the injected script escapes the noscript element into the document context.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.
AnalysisAI
Cross-site scripting in Nuxt's globally registered NoScript component allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting payload via attacker-controlled slot content, such as URL query parameters. The vulnerability exists in both supported release lines - 3.x before 3.21.7 and 4.x before 4.4.7 - and is rooted in the server-side rendering pipeline writing slot content to innerHTML without escaping, bypassing Vue's normal template sanitization. No active exploitation has been confirmed in CISA KEV; vendor-released patches are available and the fix is a one-line change confirmed in open commit history.
Technical ContextAI
The NoScript component is a globally registered Vue component in Nuxt, sourced from the @unhead/vue head-management package and re-exported by Nuxt for use in all applications. Its role is to populate the server-rendered HTML head's noscript element with slot content. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) is a single-line defect: slot text was concatenated and assigned via noscript.innerHTML rather than noscript.textContent, meaning Vue's normal double-brace escaping was irrelevant - the raw string went directly to the DOM sink. The HTML parser's 'in head noscript' insertion mode (defined by the HTML5 parsing spec) means that tags other than link, meta, noframes, or style implicitly close the noscript element and are reprocessed in the document head, causing an injected script tag to execute. Sibling components Style and Title were unaffected because they already used the textContent path. CPE cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* covers both the 3.x and 4.x affected ranges as confirmed by EUVD-2026-38112.
RemediationAI
Vendor-released patches are available: upgrade to nuxt@4.4.7 for 4.x users or nuxt@3.21.7 for 3.x users, as confirmed in GHSA-m3q2-p4fw-w38m. The fix replaces the innerHTML assignment with textContent and applies escapeHtml from @vue/shared, confirmed in commit 4b054e9d95f8daf366cb144b52782047c511a66e (4.x) and 7fea9fd687f1dacbfb63db5fae5839896b017a0e (3.x). Note that after patching, intentional HTML markup inside NoScript slots will no longer be parsed as HTML - applications that deliberately embedded HTML inside NoScript should audit this behavioral change. For teams unable to upgrade immediately, the vendor advisory recommends two workarounds: first, eliminate the pattern entirely by replacing dynamic slot content such as NoScript with {{ x }} with a static string, which removes the attack surface with no trade-off; second, if dynamic noscript content is required, use useHead({ noscript: [{ textContent: escapedValue }] }) after manually HTML-escaping the value beforehand. The second workaround carries risk if the manual escaping step is incomplete or inconsistent. See https://github.com/nuxt/nuxt/security/advisories/GHSA-m3q2-p4fw-w38m for full advisory detail.
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3. Rated critical severity (CVSS 9.8), this vulnerability is
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high seve
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high seve
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high seve
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated medium se
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1. Rated medium severity (CVSS 6.1
Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2. Rated critical severity (CVSS
Authentication/authorization bypass in Clerk's official JavaScript SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and t
Route-rule middleware bypass in Nuxt 3.11.0-3.21.6 and 4.0.0-4.4.6 allows remote attackers to evade routeRules-defined p
Nuxt is an open-source web development framework for Vue.js. Rated high severity (CVSS 7.5), this vulnerability is remot
Nuxt is an open-source web development framework for Vue.js. Rated low severity (CVSS 3.1), this vulnerability is remote
Information disclosure in Nuxt's development server exposes the project's absolute filesystem root path and a persistent
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today