DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-71318: CVE-2026-71318: Unauthorized Component Instantiation via Nuxt Server Island Props

#security #cve #cybersecurity

CVE-2026-71318: Unauthorized Component Instantiation via Nuxt Server Island Props

Vulnerability ID: CVE-2026-71318
CVSS Score: 4.8
Published: 2026-08-05

CVE-2026-71318 is a vulnerability in Nuxt where unauthenticated remote attackers can trigger unauthorized component instantiation and arbitrary HTML element injection. This security flaw is caused by default attribute inheritance (fallthrough) combined with polymorphic root components inside island components accessible via the /__nuxt_island/ endpoint. Attackers can bypass standard routing checks to instantiate globally registered components or inject raw HTML tags like iframes. This vector is highly reachable since it does not require enabling the vue.runtimeCompiler option. It is patched in Nuxt versions 3.21.10 and 4.5.1.

TL;DR

Unauthenticated remote attackers can inject arbitrary HTML elements or instantiate globally-registered Vue components via the /__nuxt_island/ endpoint by exploiting attribute fallthrough on polymorphic root elements.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-20
  • Attack Vector: Network
  • CVSS v3.1: 4.8 (Medium)
  • EPSS Score: N/A
  • Impact: HTML Injection / Component Hijacking
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • Nuxt applications utilizing Server Islands with polymorphic root components
  • nuxt: >= 3.1.0, < 3.21.10 (Fixed in: 3.21.10)
  • nuxt: >= 4.0.0, < 4.5.1 (Fixed in: 4.5.1)

Mitigation Strategies

  • Upgrade Nuxt to fixed versions (3.21.10+ / 4.5.1+)
  • Disable attribute inheritance (inheritAttrs: false) in server-side components
  • Enforce strict allowlists for dynamic components instead of raw client strings
  • Avoid globally registering sensitive UI components

Remediation Steps:

  1. Identify all server-side island components in the project matching *.server.vue.
  2. Inspect the package.json and update nuxt to either 3.21.10 or 4.5.1 depending on your version track.
  3. Examine island templates for polymorphic components or elements bound via v-bind.
  4. Implement inheritAttrs: false within island components to prevent implicit attribute fallthrough.
  5. Verify that dynamic component bindings () resolve exclusively against a predefined list of allowed tags.

References

Read the full report for CVE-2026-71318 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)