p PatchFirst

CVE-2026-71320

CVE-2026-71320 · Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.

CVSS 8.1 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • nuxt

    Versions
    • >= 4.0.0, < 4.5.1: Affected
    • >= 3.4.0, < 3.21.10: Affected

    No fix published

  • nuxt npm

    Affected ranges
    • SEMVER: ≥ 4.0.0, < 4.5.1

    Update to 4.5.1

  • nuxt npm

    Affected ranges
    • SEMVER: ≥ 3.4.0, < 3.21.10

    Update to 3.21.10

Original sources

Check your server →