Executive brief
Nuxt is a popular web framework for building Vue.js applications. A vulnerability in its NoScript component could allow attackers to execute malicious scripts in a user's browser if the application displays untrusted data within that component. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in Nuxt's globally registered <NoScript> component. The component incorrectly writes its slot content to the innerHTML of the <noscript> tag instead of using textContent, bypassing Vue's default HTML escaping. When a browser with scripting enabled parses a <noscript> tag in the <head> section, certain tags (like <script>) can cause the parser to exit the noscript context and execute the malicious payload. This is exploitable if an application interpolates attacker-controlled data into a <NoScript> slot. The issue is fixed in versions 4.4.7 and 3.21.7 by ensuring content is escaped and written to textContent.
Affected products
- Nuxt nuxt >= 4.0.0, < 4.4.7
- Nuxt nuxt < 3.21.7
Timeline
- 2026-06-02: disclosed: Initial report and publication to nuxt/nuxt repository
- 2026-06-16: advisory: GitHub Advisory published