Executive brief
Nuxt OG Image is a tool used to automatically generate social media preview images for websites. A security flaw allows attackers to inject malicious code into the pages used to generate these images. If a user is tricked into clicking a specially crafted link, an attacker could execute unauthorized scripts in their browser, potentially leading to the theft of session information or sensitive data.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the Nuxt OG Image module's image-generation component. The root cause is the incorrect parsing of GET parameters at the /_og/d/ (or /og-image/ in older versions) URI, where input is directly inserted as attributes into the HTML body without proper sanitization. An unauthenticated remote attacker can exploit this by crafting a URL with malicious attributes (e.g., onmouseover or autofocus) and tricking a user into visiting it. This allows for arbitrary JavaScript execution in the context of the victim's browser. The issue is fixed in version 6.2.5.
Affected products
- Nuxt Modules og-image < 6.2.5
Timeline
- 2026-03-28: advisory: GitHub advisory published by maintainer
- 2026-03-31: disclosed: CVE published to NVD
- 2026-03-31: patched: Fix released in version 6.2.5