PT-2026-51143 · Nuxt · Nuxt

Alcls01111 · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56317

NVD

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56317

Affected Products

Nuxt

References · 5

• https://github.com/nuxt/nuxt/commit/7fea9fd687f1dacbfb63db5fae5839896b017a0e · Patch
• https://github.com/nuxt/nuxt/security/advisories/GHSA-m3q2-p4fw-w38m · Vendor Advisory
• https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-56317 · Security Note
• https://vulncheck.com/advisories/nuxt-cross-site-scripting-via-noscript-component-slot-content · Note