Is there a patch available for CVE-2026-56698?

Yes, a patch is available for CVE-2026-56698. Update the affected software to the latest version immediately.

Nuxt CVE-2026-56698

Q: What is the CVSS score of CVE-2026-56698?

CVE-2026-56698 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38379 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-22 VulnCheck

GHSA-h345-75vh-jjwf

XSS Nuxt

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS requiring user interaction; scope change to browser origin; low C/I impact bounded to session context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 22:24 vuln.today

Analysis Generated

Jun 22, 2026 - 22:24 vuln.today

DescriptionCVE.org

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin when user-controlled input is passed to navigateTo.

AnalysisAI

Reflected XSS in Nuxt 3.x before 3.21.7 and 4.x before 4.4.7 enables client-side script execution in the application's first-party origin when user-controlled input is passed to the navigateTo() composable's open parameter. The client-side early-open handler invoked window.open(toPath, ...) without running the isScriptProtocol check that guards the normal navigation path, allowing javascript:, data:, and vbscript: scheme URLs to reach window.open() directly. No active exploitation has been confirmed (not listed in CISA KEV), but vendor-released patches are available in versions 4.4.7 and 3.21.7.

Technical ContextAI

Nuxt is a Vue.js meta-framework (npm package nuxt) used to build SSR and client-side rendered web applications. The navigateTo composable in packages/nuxt/src/app/composables/router.ts provides a documented, framework-managed navigation API. For navigations opened in a new window or tab via { open: { target: '_blank' } }, the composable exercised a fast path that called window.open(toPath, ...) before reaching the existing isScriptProtocol guard. This omission - confirmed by the commit diff at 3394716 - is the root cause: CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., XSS). The fix resolves the toPath value against window.location.href with new URL(), extracts the resolved protocol, and throws if isScriptProtocol returns true - blocking javascript:, data:, and vbscript: schemes. Affected CPE: cpe:2.3:a:nuxt:nuxt across both the 3.x and 4.x branches.

RemediationAI

Upgrade to Nuxt 4.4.7 (for 4.x users) or Nuxt 3.21.7 (for 3.x users); these are the vendor-confirmed fixed versions per GHSA-c9cv-mq2m-ppp3. The patches are at https://github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032 and https://github.com/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024d. If an immediate upgrade is not possible, the specific compensating control is to audit all call sites of navigateTo that pass an open option and ensure no user-controlled value reaches the first argument without allowlist validation; rejecting any URL whose parsed protocol is not https: or http: is sufficient. This server-side or middleware-level input validation adds latency negligible in practice but does require code changes at every affected call site. Full advisory: https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3.