# CVE-2026-34405: Nuxt OG Image reflected XSS via query parameter injection

Source: https://junglewise.ai/threats/cve-2026-34405-nuxt-og-image-reflected-xss-via-query-parameter-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34405 · Severity: medium · CVSS 6.1 · Published 2026-03-31

Nuxt OG Image is a tool used to automatically generate social media preview images for websites. A security flaw allows attackers to inject malicious code into the pages used to generate these images. If a user is tricked into clicking a specially crafted link, an attacker could execute unauthorized scripts in their browser, potentially leading to the theft of session information or sensitive data.

Technologies: [nuxt-og-image (npm)](https://junglewise.ai/threats/technologies/nuxt-og-image), [Nuxt Og-Image](https://junglewise.ai/threats/technologies/og-image). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nuxt](https://junglewise.ai/threats/vendors/nuxt).

## Quick answers

**Is CVE-2026-34405 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34405 being exploited in the wild.

**How severe is CVE-2026-34405?** Medium severity, with a CVSS score of 6.1, published 31 March 2026.

**Which products and versions are affected?** nuxt-og-image (npm) SEMVER:introduced=0,fixed=6.2.5; Nuxt Og-Image < 6.2.5.

**Is there a fix for CVE-2026-34405?** Yes. nuxt-og-image (npm): upgrade to 6.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34405 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34405?** Check whether you run nuxt-og-image (npm) or Nuxt Og-Image at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nuxt-og-image (npm): upgrade to 6.2.5 or later

  ```sh
  npm install nuxt-og-image@6.2.5
  ```


## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the Nuxt OG Image module's image-generation component. The root cause is the incorrect parsing of GET parameters at the /_og/d/ (or /og-image/ in older versions) URI, where input is directly inserted as attributes into the HTML body without proper sanitization. An unauthenticated remote attacker can exploit this by crafting a URL with malicious attributes (e.g., onmouseover or autofocus) and tricking a user into visiting it. This allows for arbitrary JavaScript execution in the context of the victim's browser. The issue is fixed in version 6.2.5.

## Affected products

- Nuxt Modules og-image < 6.2.5

## Identifiers

- CVE-2026-34405
- GHSA-mg36-wvcr-m75h

## Timeline

- 2026-03-28: advisory: GitHub advisory published by maintainer
- 2026-03-31: disclosed: CVE published to NVD
- 2026-03-31: patched: Fix released in version 6.2.5

## References

- [https://github.com/nuxt-modules/og-image/security/advisories/GHSA-mg36-wvcr-m75h](https://github.com/nuxt-modules/og-image/security/advisories/GHSA-mg36-wvcr-m75h)

## Related threats

- [Nuxt OG Image cache poisoning through derivable cache keys](https://junglewise.ai/threats/cve-2026-102527-nuxt-og-image-cache-poisoning-through-derivable-cache-keys-on)
- [Nuxt OG Image unauthenticated SSRF in font URL validation](https://junglewise.ai/threats/cve-2026-61793-nuxt-og-image-unauthenticated-ssrf-in-font-url-validation)
- [Nuxt OG Image SSRF via incomplete IPv6 denylist and redirect bypass](https://junglewise.ai/threats/cve-2026-44589-nuxt-og-image-ssrf-via-incomplete-ipv6-denylist-and-redirect)
- [Nuxt OG Image server-side request forgery in endpoint](https://junglewise.ai/threats/nuxt-og-image-server-side-request-forgery-in-endpoint-5395f83c)
- [Nuxt OG Image Denial of Service via unbounded image dimensions](https://junglewise.ai/threats/cve-2026-34404-nuxt-og-image-denial-of-service-via-unbounded-image-dimensions)