Executive brief
Nuxt is a popular web development framework used to build high-performance websites. A security flaw in its redirection system allows attackers to perform 'Cross-Site Scripting' (XSS) attacks. By tricking a user into clicking a malicious link, an attacker could execute unauthorized code in the user's browser, potentially leading to the theft of login session data or unauthorized actions on the user's behalf.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in Nuxt's `navigateTo()` composable when the `external: true` option is used. During server-side rendering (SSR), Nuxt generates an HTML body containing a `<meta http-equiv="refresh">` tag for the redirect. The destination URL was only sanitized by escaping double quotes, failing to encode other HTML-significant characters like `<`, `>`, `&`, and `'`. An attacker can provide a crafted URL (e.g., via a redirect query parameter) that breaks out of the `content` attribute to inject and execute arbitrary JavaScript in the context of the application's origin. This has been patched in versions 3.21.6 and 4.4.6 by implementing full HTML attribute encoding.
Affected products
- Nuxt Nuxt >= 3.4.3, < 3.21.6; >= 4.0.0-alpha.1, < 4.4.6
Timeline
- 2026-05-11: patched: Fix merged in GitHub pull request #35052
- 2026-05-18: advisory: GitHub Security Advisory GHSA-fx6j-w5w5-h468 published
- 2026-06-12: disclosed: CVE-2026-45669 published to NVD