CVE-2026-56317
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile — higher than 11% of all known CVEs
Summary
Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters.
Risk Assessment
Exploitation of this vulnerability could lead to the execution of malicious code in the document context, posing a serious threat to the application's security and user data.
Recommendation
It is recommended to update Nuxt to version 4.4.7 or 3.21.7 to mitigate this vulnerability. Additionally, a code audit should be conducted to identify and secure areas where untrusted data may be injected.
Original NVD description (English source)
Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.