PT-2026-51143 · Nuxt · Nuxt

Alcls01111 · Publicado 2026-06-20 · Atualizado 2026-06-20 · CVE-2026-56317

NVD

CVSS v4.0

2.3

Baixa

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-56317

Produtos afetados

Nuxt

Referências · 5

• https://github.com/nuxt/nuxt/commit/7fea9fd687f1dacbfb63db5fae5839896b017a0e · Correção
• https://github.com/nuxt/nuxt/security/advisories/GHSA-m3q2-p4fw-w38m · Aviso do Fabricante
• https://vulncheck.com/advisories/nuxt-cross-site-scripting-via-noscript-component-slot-content · Nota
• https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-56317 · Nota de Segurança