PT-2026-29371 · Unknown · Nuxt Og Image

Dmitry Prokhorov · Published 2026-03-26 · Updated 2026-04-01 · CVE-2026-34405

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nuxt OG Image versions prior to 6.2.5

Description The Nuxt OG Image package contains a flaw in the image-generation component accessible via the API endpoint / og/d/ (and /og-image/ in older versions). This issue allows for the injection of arbitrary attributes into the HTML page body through manipulation of GET parameters. Specifically, the vulnerability arises from incorrect parsing of these parameters, leading to potential HTML and JavaScript code injection. The onmouseover and autofocus parameters can be exploited to inject attributes directly into the generated HTML page.

Recommendations Versions prior to 6.2.5: Upgrade to version 6.2.5 or later to address the vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-05816

CVE-2026-34405

GHSA-MG36-WVCR-M75H

Affected Products

Nuxt Og Image

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34405.json · Exploit
• 🔥 https://github.com/nuxt-modules/og-image/security/advisories/GHSA-mg36-wvcr-m75h · Exploit
• https://osv.dev/vulnerability/GHSA-mg36-wvcr-m75h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34405 · Security Note
• https://bdu.fstec.ru/vul/2026-05816 · Security Note
• https://github.com/nuxt-modules/og-image · Note
• https://github.com/nuxt-modules/og-image/releases/tag/v6.2.5 · Note
• https://twitter.com/CVEnew/status/2039372108233314484 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2039219364306575635 · Twitter Post