Nuxt
Monthly
Route-rule middleware bypass in Nuxt 3.11.0-3.21.6 and 4.0.0-4.4.6 allows remote attackers to evade routeRules-defined protections (authentication, redirects, headers, prerender/SSR controls) by simply varying URL case, because vue-router matches paths case-insensitively while the routeRules matcher matched case-sensitively. The fix in 3.21.7 and 4.4.7 lowercases the path before matching. EPSS is 0.02% and no public exploit is identified at time of analysis, but the underlying class is trivially abused once an asymmetric rule is known.
Authentication/authorization bypass in Clerk's official JavaScript SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and the underlying @clerk/shared) allows unauthenticated remote attackers to defeat middleware-based route protection: a crafted request evades createRouteMatcher so that clerkMiddleware never invokes auth.protect(), letting the request reach protected downstream handlers such as API routes and server components. Sessions are not compromised and no user is impersonated — only the middleware gating decision is bypassed — so real impact is confined to apps that rely solely on middleware gating without redundant checks in their handlers. CVSS is 9.1 and SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is low at 0.09% (26th percentile).
Stored cross-site scripting (CWE-79) affects Nuxt 3.13.0 through 4.6.1 when server islands are combined with useHeadSafe: the island renderer serializes raw head input without preserving the safe-input marker, so NuxtIsland re-inserts it as an ordinary head entry and the allowlist no longer strips event-handler attributes or executable script. A victim must load the poisoned island page for the payload to fire. This is a genuine but conditional, medium-severity issue: the vulnerable pattern requires application code that passes attacker-controlled data into useHeadSafe inside a .server.vue component or a NuxtIsland-rendered component, which is non-default developer code. No public exploit identified at time of analysis, and no KEV listing is present.
Route-rule matching in Nuxt versions prior to 4.6.2 can be evaded by changing only the letter case of a request path, because Nuxt's page resolver is case-insensitive by default while Nitro's server-side route-rule keys are matched case-sensitively. A remote, unauthenticated attacker who requests a case-variant of a protected route can cause redirects, custom headers, proxy rules, ssr: false and noScripts to be skipped, and can make getRouteRules(event)/matchRouteRules return no rule at all for that path. This is a configuration-dependent security-control bypass rather than a high-urgency flaw: applications that set router.options.sensitive: true in nuxt.config are unaffected, and access checks implemented in server middleware, page route middleware or page data fetching remain independent and are not bypassed. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is addressed by the vendor fix in 4.6.2.
Broken access control in Nuxt (3.11.0 through 3.21.4 and 4.4.4) lets unauthenticated remote attackers retrieve pages that routeRules and appMiddleware are meant to gate, by requesting a percent-encoded form of a protected path that contains a dynamic or catch-all parameter. Route-rule keys are compared against the raw request path, while Vue Router decodes the parameter during route resolution, so the gating rule never matches and the page plus its SSR data payload is returned to the requester; the same mismatch also breaks redirect, appLayout, ssr, prerender and cache/isr/swr-derived payload rules in the app manifest. CVSS 3.1 is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) - moderate, limited confidentiality and integrity impact - and no public exploit code or confirmed active exploitation was identified at time of analysis; exposure is limited to applications that actually gate dynamic/catch-all routes via route-level rules.
Client-side script execution can be triggered in Nuxt applications running with pages disabled (all versions prior to 4.6.0) when attacker-controlled input bound to NuxtLink's `to` prop carries a leading ASCII C0 control character ahead of a `javascript:` URL. The no-pages router classifies the value as an internal route before the script-protocol check runs, so the unsafe href is emitted into server-rendered HTML; the victim must click the link for script to run in the application's origin. The issue is an incomplete fix for CVE-2026-53722, is unauthenticated (PR:N) but gated by significant preconditions - pages-disabled mode, reflected untrusted input, and a user click - and there is no public exploit identified at time of analysis; Nuxt 4.6.0 resolves it.
Cache poisoning in Nuxt OG Image 6.2.5 through 6.6.x lets unauthenticated remote attackers overwrite the cached image slot used for a site's legitimate Open Graph image by submitting attacker-controlled rendering parameters (notably the 'title' value) alongside a derived cacheKey to the dynamic /_og/d/*.png route, so spoofed image content is then served to users and crawlers that request the poisoned URL. Both the module's own CVSS 4.0 vector (6.9, AV:N/AC:L/PR:N/UI:N/VI:L) and the independent assessment (CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) agree the impact is limited to integrity of served image content - no code execution, data theft, or availability loss - and that exploitation requires a runtime deployment where URL signing has not been configured. No public exploit code was identified at time of analysis and the issue is not listed as actively exploited, but a fixed release (6.7.0), the upstream commit, and the advisory are all public, so the technical details needed to reproduce the cache-key collision are openly documented. The independent assessment characterizes this as a genuine but moderate-severity integrity issue rather than a top-priority emergency.
Unauthenticated server-side request forgery in Nuxt OG Image (the npm package nuxt-og-image) 6.0.2 through 6.6.x allows any remote attacker who can reach a deployed Nuxt site to make the server issue arbitrary outbound GET requests by supplying a crafted fonts[].path value to the public /_og/d/** image-generation route. Exploitation works against the module's documented defaults (security.strict = false, security.secret = "", restrictRuntimeImagesToOrigin = false), and the response is blind: the outer HTTP status is 500 when the internal target answers with 2xx and 200 when it fails, giving a usable oracle to enumerate live loopback, RFC1918, link-local and cloud-metadata services, while slow targets can also tie up OG image render workers for the configured fetch/render timeouts. No public exploit identified at time of analysis (no KEV listing); vendor-released patch: 6.7.0.
Information disclosure in Nuxt's development server exposes the project's absolute filesystem root path and a persistent per-project workspace UUID to unauthenticated LAN-adjacent attackers via the Chrome DevTools workspace endpoint. The prior security fix (GHSA-rq7w-g337-39qq) introduced a local-request gate that trusts the attacker-supplied Host header instead of the actual TCP peer address, meaning a non-browser client such as curl can bypass it by omitting Sec-Fetch-Site, Origin, and Referer headers while forging Host: localhost. Impact is confined to information disclosure; no public exploit has been independently identified at time of analysis, though the official advisory provides a working proof-of-concept curl command. Production builds are entirely unaffected.
Nuxt's development server on Linux exposes an unprotected vite-node IPC server via a Linux abstract-namespace Unix socket, enabling unprivileged co-resident users to read arbitrary files - including .env secrets and SSH private keys - through the SSR module pipeline. Affected are Nuxt 4.0.0 through 4.4.6 and Nuxt 3.18.0 through 3.21.6 when running `nuxt dev` on Linux with Node.js 20+, outside Docker or StackBlitz. No public exploit has been identified at time of analysis, but exploitation demands only a local shell account and basic Unix socket programming knowledge; production builds are entirely unaffected.
Reflected XSS in Nuxt 3.x before 3.21.7 and 4.x before 4.4.7 enables client-side script execution in the application's first-party origin when user-controlled input is passed to the `navigateTo()` composable's `open` parameter. The client-side early-open handler invoked `window.open(toPath, ...)` without running the `isScriptProtocol` check that guards the normal navigation path, allowing `javascript:`, `data:`, and `vbscript:` scheme URLs to reach `window.open()` directly. No active exploitation has been confirmed (not listed in CISA KEV), but vendor-released patches are available in versions 4.4.7 and 3.21.7.
Open redirect in Nuxt 3.x before 3.21.7 and 4.x before 4.4.7 allows remote unauthenticated attackers to redirect victims to arbitrary external hosts by supplying protocol-relative paths such as `//evil.com` to the `reloadNuxtApp` composable. The function's only security gate checks whether the resolved URL's scheme is a script protocol; protocol-relative paths inherit the page's own scheme (`https:`), pass that check, and are then written directly to `window.location.href`. The practical consequence is phishing and OAuth authorization-code theft on any application that forwards user-controlled input into `reloadNuxtApp`. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the GHSA advisory notes this is part of a broader cluster of three URL-handling weaknesses in Nuxt's navigation APIs.
Server-side open redirect in Nuxt's `navigateTo` composable allows unauthenticated network attackers to bypass external-host checks by submitting path-normalized payloads such as `/..//evil.com` or `/.//evil.com`, which WHATWG URL parsing resolves to the protocol-relative URL `//evil.com`. Affected versions are Nuxt 4.0.0-4.4.6 and all 3.x releases before 3.21.7. Because Nuxt documentation presents `navigateTo` as the safe, built-in mechanism for post-login redirects, applications commonly pass unvalidated user-supplied redirect parameters directly to it - making OAuth authorization-code theft and phishing the principal real-world risks. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Cross-site scripting in Nuxt's globally registered NoScript component allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting payload via attacker-controlled slot content, such as URL query parameters. The vulnerability exists in both supported release lines - 3.x before 3.21.7 and 4.x before 4.4.7 - and is rooted in the server-side rendering pipeline writing slot content to innerHTML without escaping, bypassing Vue's normal template sanitization. No active exploitation has been confirmed in CISA KEV; vendor-released patches are available and the fix is a one-line change confirmed in open commit history.
Reflected DOM-based XSS in Nuxt's built-in <NuxtLink> component allows an unauthenticated attacker to inject script-capable URLs (javascript:, vbscript:) that execute in the application's origin when a victim clicks a crafted link, affecting all Nuxt v3 versions prior to 3.21.7 and v4 versions prior to 4.4.7. Exploitation is contingent on application code that binds attacker-controlled input - such as query parameters, CMS link fields, or user-supplied profile URLs - directly to the component's to or href props without prior sanitization. No public exploit code has been identified and the EPSS score of 0.06% (20th percentile) indicates low observed exploitation probability; vendor-released patches are available in versions 3.21.7 and 4.4.7.
Source code exfiltration in Nuxt's @nuxt/webpack-builder and @nuxt/rspack-builder (versions 3.15.4-3.21.6 and 4.0.0-alpha.1-4.4.6) enables a LAN-adjacent attacker to read a developer's full application source from the webpack dev server when it is bound to a non-loopback address via `nuxt dev --host`. This is a second incomplete fix in a chain stemming from GHSA-4gf7-ff8x-hq99: the previous patch (GHSA-6m52-m754-pw2g) relied on Sec-Fetch-* metadata headers that browsers silently omit for non-trustworthy (plain HTTP) origins, leaving a bypass when an attacker page strips all three identifying headers (Sec-Fetch-Site, Origin, Referer) simultaneously. A proof-of-concept JavaScript payload is documented in the GHSA advisory; EPSS is very low at 0.02% (7th percentile) and no CISA KEV entry exists, reflecting the narrow exploitation conditions required.
A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Nuxt is an open-source web development framework for Vue.js. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Nuxt is an open-source web development framework for Vue.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Route-rule middleware bypass in Nuxt 3.11.0-3.21.6 and 4.0.0-4.4.6 allows remote attackers to evade routeRules-defined protections (authentication, redirects, headers, prerender/SSR controls) by simply varying URL case, because vue-router matches paths case-insensitively while the routeRules matcher matched case-sensitively. The fix in 3.21.7 and 4.4.7 lowercases the path before matching. EPSS is 0.02% and no public exploit is identified at time of analysis, but the underlying class is trivially abused once an asymmetric rule is known.
Authentication/authorization bypass in Clerk's official JavaScript SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and the underlying @clerk/shared) allows unauthenticated remote attackers to defeat middleware-based route protection: a crafted request evades createRouteMatcher so that clerkMiddleware never invokes auth.protect(), letting the request reach protected downstream handlers such as API routes and server components. Sessions are not compromised and no user is impersonated — only the middleware gating decision is bypassed — so real impact is confined to apps that rely solely on middleware gating without redundant checks in their handlers. CVSS is 9.1 and SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is low at 0.09% (26th percentile).
Stored cross-site scripting (CWE-79) affects Nuxt 3.13.0 through 4.6.1 when server islands are combined with useHeadSafe: the island renderer serializes raw head input without preserving the safe-input marker, so NuxtIsland re-inserts it as an ordinary head entry and the allowlist no longer strips event-handler attributes or executable script. A victim must load the poisoned island page for the payload to fire. This is a genuine but conditional, medium-severity issue: the vulnerable pattern requires application code that passes attacker-controlled data into useHeadSafe inside a .server.vue component or a NuxtIsland-rendered component, which is non-default developer code. No public exploit identified at time of analysis, and no KEV listing is present.
Route-rule matching in Nuxt versions prior to 4.6.2 can be evaded by changing only the letter case of a request path, because Nuxt's page resolver is case-insensitive by default while Nitro's server-side route-rule keys are matched case-sensitively. A remote, unauthenticated attacker who requests a case-variant of a protected route can cause redirects, custom headers, proxy rules, ssr: false and noScripts to be skipped, and can make getRouteRules(event)/matchRouteRules return no rule at all for that path. This is a configuration-dependent security-control bypass rather than a high-urgency flaw: applications that set router.options.sensitive: true in nuxt.config are unaffected, and access checks implemented in server middleware, page route middleware or page data fetching remain independent and are not bypassed. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is addressed by the vendor fix in 4.6.2.
Broken access control in Nuxt (3.11.0 through 3.21.4 and 4.4.4) lets unauthenticated remote attackers retrieve pages that routeRules and appMiddleware are meant to gate, by requesting a percent-encoded form of a protected path that contains a dynamic or catch-all parameter. Route-rule keys are compared against the raw request path, while Vue Router decodes the parameter during route resolution, so the gating rule never matches and the page plus its SSR data payload is returned to the requester; the same mismatch also breaks redirect, appLayout, ssr, prerender and cache/isr/swr-derived payload rules in the app manifest. CVSS 3.1 is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) - moderate, limited confidentiality and integrity impact - and no public exploit code or confirmed active exploitation was identified at time of analysis; exposure is limited to applications that actually gate dynamic/catch-all routes via route-level rules.
Client-side script execution can be triggered in Nuxt applications running with pages disabled (all versions prior to 4.6.0) when attacker-controlled input bound to NuxtLink's `to` prop carries a leading ASCII C0 control character ahead of a `javascript:` URL. The no-pages router classifies the value as an internal route before the script-protocol check runs, so the unsafe href is emitted into server-rendered HTML; the victim must click the link for script to run in the application's origin. The issue is an incomplete fix for CVE-2026-53722, is unauthenticated (PR:N) but gated by significant preconditions - pages-disabled mode, reflected untrusted input, and a user click - and there is no public exploit identified at time of analysis; Nuxt 4.6.0 resolves it.
Cache poisoning in Nuxt OG Image 6.2.5 through 6.6.x lets unauthenticated remote attackers overwrite the cached image slot used for a site's legitimate Open Graph image by submitting attacker-controlled rendering parameters (notably the 'title' value) alongside a derived cacheKey to the dynamic /_og/d/*.png route, so spoofed image content is then served to users and crawlers that request the poisoned URL. Both the module's own CVSS 4.0 vector (6.9, AV:N/AC:L/PR:N/UI:N/VI:L) and the independent assessment (CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) agree the impact is limited to integrity of served image content - no code execution, data theft, or availability loss - and that exploitation requires a runtime deployment where URL signing has not been configured. No public exploit code was identified at time of analysis and the issue is not listed as actively exploited, but a fixed release (6.7.0), the upstream commit, and the advisory are all public, so the technical details needed to reproduce the cache-key collision are openly documented. The independent assessment characterizes this as a genuine but moderate-severity integrity issue rather than a top-priority emergency.
Unauthenticated server-side request forgery in Nuxt OG Image (the npm package nuxt-og-image) 6.0.2 through 6.6.x allows any remote attacker who can reach a deployed Nuxt site to make the server issue arbitrary outbound GET requests by supplying a crafted fonts[].path value to the public /_og/d/** image-generation route. Exploitation works against the module's documented defaults (security.strict = false, security.secret = "", restrictRuntimeImagesToOrigin = false), and the response is blind: the outer HTTP status is 500 when the internal target answers with 2xx and 200 when it fails, giving a usable oracle to enumerate live loopback, RFC1918, link-local and cloud-metadata services, while slow targets can also tie up OG image render workers for the configured fetch/render timeouts. No public exploit identified at time of analysis (no KEV listing); vendor-released patch: 6.7.0.
Information disclosure in Nuxt's development server exposes the project's absolute filesystem root path and a persistent per-project workspace UUID to unauthenticated LAN-adjacent attackers via the Chrome DevTools workspace endpoint. The prior security fix (GHSA-rq7w-g337-39qq) introduced a local-request gate that trusts the attacker-supplied Host header instead of the actual TCP peer address, meaning a non-browser client such as curl can bypass it by omitting Sec-Fetch-Site, Origin, and Referer headers while forging Host: localhost. Impact is confined to information disclosure; no public exploit has been independently identified at time of analysis, though the official advisory provides a working proof-of-concept curl command. Production builds are entirely unaffected.
Nuxt's development server on Linux exposes an unprotected vite-node IPC server via a Linux abstract-namespace Unix socket, enabling unprivileged co-resident users to read arbitrary files - including .env secrets and SSH private keys - through the SSR module pipeline. Affected are Nuxt 4.0.0 through 4.4.6 and Nuxt 3.18.0 through 3.21.6 when running `nuxt dev` on Linux with Node.js 20+, outside Docker or StackBlitz. No public exploit has been identified at time of analysis, but exploitation demands only a local shell account and basic Unix socket programming knowledge; production builds are entirely unaffected.
Reflected XSS in Nuxt 3.x before 3.21.7 and 4.x before 4.4.7 enables client-side script execution in the application's first-party origin when user-controlled input is passed to the `navigateTo()` composable's `open` parameter. The client-side early-open handler invoked `window.open(toPath, ...)` without running the `isScriptProtocol` check that guards the normal navigation path, allowing `javascript:`, `data:`, and `vbscript:` scheme URLs to reach `window.open()` directly. No active exploitation has been confirmed (not listed in CISA KEV), but vendor-released patches are available in versions 4.4.7 and 3.21.7.
Open redirect in Nuxt 3.x before 3.21.7 and 4.x before 4.4.7 allows remote unauthenticated attackers to redirect victims to arbitrary external hosts by supplying protocol-relative paths such as `//evil.com` to the `reloadNuxtApp` composable. The function's only security gate checks whether the resolved URL's scheme is a script protocol; protocol-relative paths inherit the page's own scheme (`https:`), pass that check, and are then written directly to `window.location.href`. The practical consequence is phishing and OAuth authorization-code theft on any application that forwards user-controlled input into `reloadNuxtApp`. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the GHSA advisory notes this is part of a broader cluster of three URL-handling weaknesses in Nuxt's navigation APIs.
Server-side open redirect in Nuxt's `navigateTo` composable allows unauthenticated network attackers to bypass external-host checks by submitting path-normalized payloads such as `/..//evil.com` or `/.//evil.com`, which WHATWG URL parsing resolves to the protocol-relative URL `//evil.com`. Affected versions are Nuxt 4.0.0-4.4.6 and all 3.x releases before 3.21.7. Because Nuxt documentation presents `navigateTo` as the safe, built-in mechanism for post-login redirects, applications commonly pass unvalidated user-supplied redirect parameters directly to it - making OAuth authorization-code theft and phishing the principal real-world risks. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Cross-site scripting in Nuxt's globally registered NoScript component allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting payload via attacker-controlled slot content, such as URL query parameters. The vulnerability exists in both supported release lines - 3.x before 3.21.7 and 4.x before 4.4.7 - and is rooted in the server-side rendering pipeline writing slot content to innerHTML without escaping, bypassing Vue's normal template sanitization. No active exploitation has been confirmed in CISA KEV; vendor-released patches are available and the fix is a one-line change confirmed in open commit history.
Reflected DOM-based XSS in Nuxt's built-in <NuxtLink> component allows an unauthenticated attacker to inject script-capable URLs (javascript:, vbscript:) that execute in the application's origin when a victim clicks a crafted link, affecting all Nuxt v3 versions prior to 3.21.7 and v4 versions prior to 4.4.7. Exploitation is contingent on application code that binds attacker-controlled input - such as query parameters, CMS link fields, or user-supplied profile URLs - directly to the component's to or href props without prior sanitization. No public exploit code has been identified and the EPSS score of 0.06% (20th percentile) indicates low observed exploitation probability; vendor-released patches are available in versions 3.21.7 and 4.4.7.
Source code exfiltration in Nuxt's @nuxt/webpack-builder and @nuxt/rspack-builder (versions 3.15.4-3.21.6 and 4.0.0-alpha.1-4.4.6) enables a LAN-adjacent attacker to read a developer's full application source from the webpack dev server when it is bound to a non-loopback address via `nuxt dev --host`. This is a second incomplete fix in a chain stemming from GHSA-4gf7-ff8x-hq99: the previous patch (GHSA-6m52-m754-pw2g) relied on Sec-Fetch-* metadata headers that browsers silently omit for non-trustworthy (plain HTTP) origins, leaving a bypass when an attacker page strips all three identifying headers (Sec-Fetch-Site, Origin, Referer) simultaneously. A proof-of-concept JavaScript payload is documented in the GHSA advisory; EPSS is very low at 0.02% (7th percentile) and no CISA KEV entry exists, reflecting the narrow exploitation conditions required.
A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Nuxt is an open-source web development framework for Vue.js. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Nuxt is an open-source web development framework for Vue.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.