CVE-2026-34405: Nuxt OG Image reflected XSS via query parameter injection

CVE-2026-34405 · Severity: medium · CVSS 6.1 · Published 2026-03-31

Nuxt OG Image is a tool used to automatically generate social media preview images for websites. A security flaw allows attackers to inject malicious code into the pages used to generate these images. If a user is tricked into clicking a specially crafted link, an attacker could execute unauthorized scripts in their browser, potentially leading to the theft of session information or sensitive data.

Technologies: nuxt-og-image (npm), Nuxt Og-Image. Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-34405 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34405 being exploited in the wild.
How severe is CVE-2026-34405?
Medium severity, with a CVSS score of 6.1, published 31 March 2026.
Which products and versions are affected?
nuxt-og-image (npm) SEMVER:introduced=0,fixed=6.2.5; Nuxt Og-Image < 6.2.5.
Is there a fix for CVE-2026-34405?
Yes. nuxt-og-image (npm): upgrade to 6.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34405 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34405?
Check whether you run nuxt-og-image (npm) or Nuxt Og-Image at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nuxt-og-image (npm): upgrade to 6.2.5 or later
    npm install nuxt-og-image@6.2.5

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the Nuxt OG Image module's image-generation component. The root cause is the incorrect parsing of GET parameters at the /_og/d/ (or /og-image/ in older versions) URI, where input is directly inserted as attributes into the HTML body without proper sanitization. An unauthenticated remote attacker can exploit this by crafting a URL with malicious attributes (e.g., onmouseover or autofocus) and tricking a user into visiting it. This allows for arbitrary JavaScript execution in the context of the victim's browser. The issue is fixed in version 6.2.5.

Affected products

  • Nuxt Modules og-image < 6.2.5

Identifiers

  • CVE-2026-34405
  • GHSA-mg36-wvcr-m75h

Timeline

  • 2026-03-28: advisory: GitHub advisory published by maintainer
  • 2026-03-31: disclosed: CVE published to NVD
  • 2026-03-31: patched: Fix released in version 6.2.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.