CVE-2026-56317

CVE-2026-56317 · Nuxt - Cross-Site Scripting via NoScript Component Slot Content

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.

CVSS 2.3 · Low · EPSS 0.3% · Fix available

Published: 2026-06-20T15:21:56.449Z
Updated: 2026-06-24T17:53:34.670Z

Stack: node

Affected products and versions

nuxt
Versions
- ≥ 4.0.0, < 4.4.7: Affected (semver)
- 4.4.7: Not affected (semver)
Update to 4.4.7
nuxt
Versions
- ≥ 0, < 3.21.7: Affected (semver)
- 3.21.7: Not affected (semver)
Update to 3.21.7
nuxt npm
Affected ranges
- SEMVER: ≥ 4.0.0, < 4.4.7
Update to 4.4.7
nuxt npm
Affected ranges
- SEMVER: < 3.21.7
Update to 3.21.7

Original sources

Check your server →