PT-2026-41962 · Git+2 · Nuxt
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Nuxt versions 3.4.3 through 3.21.5
Nuxt versions 4.0.0-alpha.1 through 4.4.5
Description
When using the
navigateTo() function with the external: true option, the software generates a server-side HTML redirect body containing a <meta http-equiv="refresh"> tag. The destination URL is insufficiently sanitized, as only double quotes are replaced with %22, while characters such as <, >, &, and ' remain unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content attribute to inject arbitrary HTML or JavaScript. This results in reflected cross-site scripting (XSS), where the injected script executes under the application's origin during the server-rendered redirect response. This typically occurs in applications that pass user-controlled input, such as ?next= or ?redirect= query parameters, to the navigateTo() function.Recommendations
Update Nuxt to version 3.21.6 or later.
Update Nuxt to version 4.4.6 or later.
As a temporary workaround, validate user-controlled URLs before passing them to the
navigateTo() function by normalizing them through new URL(input).toString() and rejecting any inputs containing < or > characters.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nuxt