PT-2026-29371 · Unknown · Nuxt Og Image

Dmitry Prokhorov · Publicado 2026-03-26 · Atualizado 2026-04-01 · CVE-2026-34405

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nuxt OG Image versions prior to 6.2.5

Description The Nuxt OG Image package contains a flaw in the image-generation component accessible via the API endpoint / og/d/ (and /og-image/ in older versions). This issue allows for the injection of arbitrary attributes into the HTML page body through manipulation of GET parameters. Specifically, the vulnerability arises from incorrect parsing of these parameters, leading to potential HTML and JavaScript code injection. The onmouseover and autofocus parameters can be exploited to inject attributes directly into the generated HTML page.

Recommendations Versions prior to 6.2.5: Upgrade to version 6.2.5 or later to address the vulnerability.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2026-05816

CVE-2026-34405

GHSA-MG36-WVCR-M75H

Produtos afetados

Nuxt Og Image

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34405.json · Exploit
• 🔥 https://github.com/nuxt-modules/og-image/security/advisories/GHSA-mg36-wvcr-m75h · Exploit
• https://github.com/nuxt-modules/og-image · Nota
• https://github.com/nuxt-modules/og-image/releases/tag/v6.2.5 · Nota
• https://twitter.com/CVEnew/status/2039372108233314484 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-mg36-wvcr-m75h · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-34405 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34405 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-05816 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2039219364306575635 · Publicação no Twitter