Executive brief
Nuxt's NoScript component, used to display content when JavaScript is disabled, has a cross-site scripting (XSS) flaw that allows attackers to inject malicious code through untrusted user input placed in the component. When an application displays unvalidated data (such as URL parameters) inside a NoScript slot, an attacker can craft a malicious payload that executes JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or malware distribution. This requires user interaction (loading a malicious link) but can impact any Nuxt application that uses NoScript with dynamic content.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw in Nuxt's NoScript component. The root cause is that the component writes slot content directly to the noscript element's innerHTML property without HTML escaping. The attack vector is network-based and requires user interaction (clicking a link with malicious query parameters). When an attacker-controlled value is placed in a NoScript slot (e.g., <NoScript>{{ route.query.banner }}</NoScript>), the unescaped content is rendered in the server-side HTML. With JavaScript enabled, the HTML parser's "in head noscript" insertion mode treats certain tags (like <script>) as closing the noscript tag, causing the script to execute in the document context. The fix, applied in nuxt@4.4.7 and backported to nuxt@3.21.7, escapes content with escapeHtml from @vue/shared and writes to textContent instead of innerHTML, preventing markup parsing.
Affected products
- Nuxt Nuxt >= 4.0.0, < 4.4.7
- Nuxt Nuxt < 3.21.7
Timeline
- 2026-06-20: disclosed: Advisory published to GitHub Advisory Database
- 2026-06-02: patched: Fixed in nuxt@4.4.7 (commit 4b054e9d) and nuxt@3.21.7 (commit 7fea9fd6)
- 2026-09-09: other: Advisory withdrawn as duplicate of GHSA-m3q2-p4fw-w38m
References
- https://github.com/nuxt/nuxt/security/advisories/GHSA-m3q2-p4fw-w38m
- https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e
- https://github.com/nuxt/nuxt/commit/7fea9fd687f1dacbfb63db5fae5839896b017a0e
- https://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-noscript-component-slot-content