Junglewise Threat Intelligence

Nuxt NoScript component cross-site scripting

Severity: low · CVSS 2.3 · Published 2026-06-20

Vendors: Nuxt.

Executive brief

Nuxt's NoScript component, used to display content when JavaScript is disabled, has a cross-site scripting (XSS) flaw that allows attackers to inject malicious code through untrusted user input placed in the component. When an application displays unvalidated data (such as URL parameters) inside a NoScript slot, an attacker can craft a malicious payload that executes JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or malware distribution. This requires user interaction (loading a malicious link) but can impact any Nuxt application that uses NoScript with dynamic content.

Technical details

The vulnerability is a Cross-Site Scripting (CWE-79) flaw in Nuxt's NoScript component. The root cause is that the component writes slot content directly to the noscript element's innerHTML property without HTML escaping. The attack vector is network-based and requires user interaction (clicking a link with malicious query parameters). When an attacker-controlled value is placed in a NoScript slot (e.g., <NoScript>{{ route.query.banner }}</NoScript>), the unescaped content is rendered in the server-side HTML. With JavaScript enabled, the HTML parser's "in head noscript" insertion mode treats certain tags (like <script>) as closing the noscript tag, causing the script to execute in the document context. The fix, applied in nuxt@4.4.7 and backported to nuxt@3.21.7, escapes content with escapeHtml from @vue/shared and writes to textContent instead of innerHTML, preventing markup parsing.

Affected products

  • Nuxt Nuxt >= 4.0.0, < 4.4.7
  • Nuxt Nuxt < 3.21.7

Timeline

  • 2026-06-20: disclosed: Advisory published to GitHub Advisory Database
  • 2026-06-02: patched: Fixed in nuxt@4.4.7 (commit 4b054e9d) and nuxt@3.21.7 (commit 7fea9fd6)
  • 2026-09-09: other: Advisory withdrawn as duplicate of GHSA-m3q2-p4fw-w38m

References