Executive brief
Nuxt is a popular web framework for building Vue.js applications. A vulnerability in its 'server islands' feature allows attackers to execute malicious code on the server if specific configuration settings are enabled. This could lead to a full system compromise, unauthorized data access, or service disruption.
Technical details
A remote code execution (RCE) vulnerability exists in Nuxt core when 'Server Islands' are used in conjunction with the Vue runtime compiler (vue.runtimeCompiler: true). Attackers can inject a 'template' key into island props via the /__nuxt_island/ endpoint. If these props are forwarded to dynamic component resolution functions like <component :is>, resolveDynamicComponent, or h(), the Vue runtime compiler will execute the attacker-controlled template in the server process. This can occur even without explicit prop forwarding due to Vue's attribute inheritance (fallthrough) if the island's root is a polymorphic component. The vulnerability is fixed in Nuxt versions 3.21.10 and 4.5.1.
Affected products
- Nuxt Nuxt >= 3.4.0, < 3.21.10; >= 4.0.0, < 4.5.1
Timeline
- 2026-07-27: disclosed: Initial disclosure by developer
- 2026-08-05: advisory: GitHub Advisory published
- 2026-08-05: patched: Fixes released in 3.21.10 and 4.5.1
References
- https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq
- https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418
- https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859
- https://github.com/nuxt/nuxt/releases/tag/v3.21.10
- https://github.com/nuxt/nuxt/releases/tag/v4.5.1
- https://api.github.com/repos/nuxt/nuxt/security-advisories/GHSA-9473-5f9j-94wq