Back to overview

CVE-2026-56317

LOW
2.3
CVSS 4.0
Description
Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.

Metadata

CVE ID
CVE-2026-56317
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-06-20 12:59 UTC
Published
2026-06-20 15:21 UTC
Last updated
2026-06-20 15:21 UTC
Primary CWE
CWE-79
Improper Neutralization of Input During Web Page Generation …
Vendor / Product
Nuxt / Nuxt
Sources
cve.org  ·  NVD

Severity & Metrics

2.3 LOW CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products (2)
VendorProductPlatformVersions
Nuxt Nuxt — 4.0.0 < 4.4.7, 4.4.7
Nuxt Nuxt — 0 < 3.21.7, 3.21.7
Weakness (CWE)
CWESourceDescription
CWE-79 cna Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS scores (1)
ScoreSeverityVersionSourceVector
2.3 LOW 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References (4)
Back to overview