{"id":"CVE-2026-114133","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","summary":"Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland lat…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"nuxt","product":"nuxt","affected":["nuxt >= 3.13.0, < 4.6.2"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T17:53:26.503Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114133","references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x","label":"https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x"},{"url":"https://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0","label":"https://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.2","label":"https://github.com/nuxt/nuxt/releases/tag/v4.6.2"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T18:09:27.270Z","slug":"CVE-2026-114133","body":"## Overview\n\nNuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .\n\n## Affected\n\n- `nuxt >= 3.13.0, < 4.6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}