DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-71320: CVE-2026-71320: Remote Code Execution in Nuxt via Server-Side Template Injection in Server Islands

#security #cve #cybersecurity

CVE-2026-71320: Remote Code Execution in Nuxt via Server-Side Template Injection in Server Islands

Vulnerability ID: CVE-2026-71320
CVSS Score: 8.1
Published: 2026-08-05

A highly critical Server-Side Remote Code Execution (RCE) vulnerability exists in the Nuxt framework when Server Islands and the Vue runtime compiler are simultaneously enabled. This allows unauthenticated remote attackers to execute arbitrary system commands on the host process by passing a crafted component definition object to the dynamic component resolution engine via public island endpoints.

TL;DR

Unauthenticated Remote Code Execution (RCE) in Nuxt via Server-Side Template Injection (SSTI) when the Vue runtime compiler is enabled, triggered through crafted props sent to Server Island endpoints.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94: Improper Control of Generation of Code ('Code Injection')
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.1 (High)
  • EPSS Score: Not Registered / New CVE
  • Impact: Server-Side Remote Code Execution (RCE)
  • Exploit Status: Proof-of-Concept (PoC)
  • KEV Status: Not Listed

Affected Systems

  • Nuxt 3.x applications with server islands and runtime compiler active
  • Nuxt 4.x applications with server islands and runtime compiler active
  • Nuxt: >= 3.4.0, < 3.21.10 (Fixed in: 3.21.10)
  • Nuxt: >= 4.0.0, < 4.5.1 (Fixed in: 4.5.1)

Code Analysis

Commit: 5b60017

fix(nuxt): prevent template injection in island props

Commit: ee6c846

test(nuxt): add test cases for findUnsafeIslandPropKey

Exploit Details

  • GitHub Advisory: Conceptual breakdown of the Server Island SSTI vulnerability

Mitigation Strategies

  • Upgrade to Nuxt 3.21.10 or 4.5.1 to leverage built-in island prop filtering.
  • Set vue.runtimeCompiler to false in nuxt.config.ts to block server-side compiling.
  • Configure WAF rules to reject HTTP requests containing a nested template key targeted at /__nuxt_island/.

Remediation Steps:

  1. Analyze nuxt.config.ts for the presence of vue.runtimeCompiler: true.
  2. If the runtime compiler is not required, disable or remove the line.
  3. Run npm update nuxt or yarn upgrade nuxt to fetch versions >= 3.21.10 or >= 4.5.1.
  4. Deploy the updated application and verify that island requests containing a template prop return HTTP 400.

References

Read the full report for CVE-2026-71320 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)