CVE-2026-34405
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Nuxt OG Image before version 6.2.5 has a vulnerability in the image-generation component via URI /_og/d/ (and /og-image/ in older versions) that allows injection of arbitrary attributes into the HTML page body. A fix is available in version 6.2.5.
Risk Assessment
An attacker can inject malicious HTML attributes, potentially leading to XSS attacks or page appearance modification.
Recommendation
Update Nuxt OG Image to version 6.2.5, which contains the fix.
Original NVD description (English source)
Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in version 6.2.5.