Is CVE-2026-56317 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56317 being exploited in the wild.

How severe is CVE-2026-56317?

Medium severity, with a CVSS score of 4, published 20 June 2026.

Which products and versions are affected?

nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.

Is there a fix for CVE-2026-56317?

Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56317 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56317?

Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56317: Nuxt XSS in NoScript component slot content

CVE-2026-56317 · Severity: medium · CVSS 4 · Published 2026-06-20

Nuxt is a popular web development framework used to build high-performance websites. A security flaw in its NoScript component allows attackers to inject malicious scripts into a webpage if the site displays untrusted user data (like URL parameters) inside that component. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or redirecting users to malicious sites.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is CVE-2026-56317 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56317 being exploited in the wild.
How severe is CVE-2026-56317?: Medium severity, with a CVSS score of 4, published 20 June 2026.
Which products and versions are affected?: nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.
Is there a fix for CVE-2026-56317?: Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56317 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56317?: Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 4.4.7 or later
```
npm install nuxt@4.4.7
```

Technical details

A cross-site scripting (XSS) vulnerability exists in the Nuxt <NoScript> component (re-exported from @unhead/vue). The component incorrectly writes its default-slot content to the 'innerHTML' property of the <noscript> head tag instead of using 'textContent', bypassing Vue's standard HTML escaping. When a browser with JavaScript enabled parses the server-rendered HTML, certain tags (like <script>) inside the <noscript> block in the <head> section will implicitly close the <noscript> tag and execute in the document context. Attackers can exploit this by providing malicious payloads through untrusted data sources, such as 'route.query' parameters, if they are interpolated into the <NoScript> slot. The issue is fixed in Nuxt versions 4.4.7 and 3.21.7 by switching to 'textContent' and using 'escapeHtml' from @vue/shared.

Affected products

Nuxt Nuxt >= 4.0.0, < 4.4.7; < 3.21.7

Identifiers

CVE-2026-56317
GHSA-m3q2-p4fw-w38m

Timeline

2026-06-02: advisory: GitHub Security Advisory GHSA-m3q2-p4fw-w38m published
2026-06-20: disclosed: CVE-2026-56317 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.