CVE-2026-56317

Nuxt - Cross-Site Scripting via NoScript Component Slot Content

State: Published
Severity: 2.3 Low
Published: Jun 20, 2026
Updated: Jun 24, 2026
Reserved: Jun 20, 2026

Description

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
NuxtNuxt	4.0.0 to before 4.4.7Affected 4.4.7Not affected
NuxtNuxt	before 3.21.7Affected 3.21.7Not affected

References

GHSA Advisory GHSA-m3q2-p4fw-w38mvendor-advisory
https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66epatch
https://github.com/nuxt/nuxt/commit/7fea9fd687f1dacbfb63db5fae5839896b017a0epatch
VulnCheck Advisory: Nuxt - Cross-Site Scripting via NoScript Component Slot Contentthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.