CVE-2026-53722: Reflected DOM-based Cross-Site Scripting (XSS) in Nuxt
Vulnerability ID: CVE-2026-53722
CVSS Score: 5.4
Published: 2026-06-16
A reflected DOM-based Cross-Site Scripting (XSS) vulnerability was identified in Nuxt's core component. Prior to the patched versions, the component failed to validate or sanitize the target URI schemes before directly rendering them into the 'href' attribute of native HTML anchor elements. An attacker who controls the input bound to the 'to' or 'href' properties can inject executable URI schemes, such as 'javascript:' or 'data:', leading to arbitrary script execution in the context of the user's browser session.
TL;DR
Nuxt <NuxtLink> components prior to versions 3.21.7 and 4.4.7 fail to sanitize URL schemes, enabling DOM-based XSS when binding untrusted, attacker-controlled navigation targets.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network
- CVSS Score: 5.4 (Medium)
- EPSS Score: 0.00198
- Impact: Reflected DOM-based Cross-Site Scripting (XSS)
- Exploit Status: Proof-of-Concept (PoC)
- KEV Status: Not Listed
Affected Systems
- Nuxt Framework v3 (before version 3.21.7)
- Nuxt Framework v4 (before version 4.4.7)
-
Nuxt: < 3.21.7 (Fixed in:
3.21.7) -
Nuxt: >= 4.0.0, < 4.4.7 (Fixed in:
4.4.7)
Code Analysis
Commit: 0103ce0
Core patch adding sanitizeExternalHref helper to sanitize client-bound external links
Commit: 5328404
Cherry-picked v3 patch for sanitizeExternalHref implementation
Exploit Details
- GitHub Security Advisory: Vulnerability disclosure with proof-of-concept guidelines for application maintainers.
Mitigation Strategies
- Upgrade the Nuxt framework to a non-vulnerable version.
- Enforce strict URI validation on user-controlled redirect targets before routing.
- Implement a robust Content Security Policy (CSP) restricting execution of inline scripts.
Remediation Steps:
- Open your package management configuration file (package.json).
- Locate the 'nuxt' dependency entry.
- Update the version definition to '^3.21.7' for Nuxt v3 projects or '^4.4.7' for Nuxt v4 projects.
- Execute your package manager upgrade command (e.g., 'npm install', 'yarn install', or 'pnpm install') to retrieve and link the updated package assets.
- Deploy the updated application to production environments and verify that the 'sanitizeExternalHref' logic blocks any 'javascript:' injection attempts.
References
Read the full report for CVE-2026-53722 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)