GHSA-xppm-jmw6-fhmfLow▾ SunlitDuplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-m3q2-p4fw-w38m. This link is maintained to preserve external references.
Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.
nuxt >= 4.0.0, < 4.4.7nuxt < 3.21.7Upgrade to a patched release:
nuxt 4.4.7nuxt 3.21.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56317LowCross-site scripting via <NoScript> slot content in Nuxt's head components
GHSA-m3q2-p4fw-w38mLowCross-site scripting via <NoScript> slot content in Nuxt's head components
CVE-2026-56326Medium· 6.1Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`
CVE-2026-53722MediumNuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
GHSA-2x6f-57hp-86fxMedium· 5.5Duplicate Advisory: Nuxt dev server vite-node IPC socket is world-connectable on Linux
CVE-2026-56301Medium· 5.5Nuxt dev server vite-node IPC socket is world-connectable on Linux