CVE-2026-56317
CVE-2026-56317 · Nuxt - Cross-Site Scripting via NoScript Component Slot Content
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.
CVSS 2.3 · Baja · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
nuxt
- Versiones
- ≥ 4.0.0, < 4.4.7: Afectada (semver)
- 4.4.7: No afectada (semver)
Actualiza a 4.4.7
nuxt
- Versiones
- ≥ 0, < 3.21.7: Afectada (semver)
- 3.21.7: No afectada (semver)
Actualiza a 3.21.7
nuxt npm
- Intervalos de versiones afectados
- SEMVER: ≥ 4.0.0, < 4.4.7
Actualiza a 4.4.7
nuxt npm
- Intervalos de versiones afectados
- SEMVER: < 3.21.7
Actualiza a 3.21.7
Fuentes originales
- https://github.com/nuxt/nuxt/security/advisories/GHSA-m3q2-p4fw-w38m
- https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e
- https://github.com/nuxt/nuxt/commit/7fea9fd687f1dacbfb63db5fae5839896b017a0e
- https://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-noscript-component-slot-content
- https://nvd.nist.gov/vuln/detail/CVE-2026-56317