Nuxt NoScript cross-site scripting via unescaped slot content

Severity: medium · CVSS 4 · Published 2026-06-20

Nuxt's NoScript component, used to handle content for users with JavaScript disabled, contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through untrusted data. When attackers control content displayed in NoScript slots (such as through URL query parameters), they can execute arbitrary JavaScript in the browser, potentially compromising user sessions and stealing sensitive information.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 4, published 20 June 2026.
Which products and versions are affected?
nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.
Is there a fix for This vulnerability?
Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nuxt (npm): upgrade to 4.4.7 or later
    npm install nuxt@4.4.7

Technical details

The vulnerability is a cross-site scripting (CWE-79) flaw in Nuxt's NoScript component from @unhead/vue, which writes slot content directly to the innerHTML of the noscript tag without proper HTML escaping. An attacker can inject payloads like <script>alert(1)</script> through untrusted sources (e.g., route.query parameters). When JavaScript is enabled, the HTML parser treats the noscript tag in the head with special parsing rules; a script tag implicitly closes the noscript element and executes in the document context. The attack requires network access and user interaction (a victim visiting a crafted URL), but no authentication. The fix, released in versions 4.4.7 and 3.21.7, escapes slot content using escapeHtml and writes to textContent instead of innerHTML.

Affected products

  • Nuxt Nuxt 4.0.0 to <4.4.7; <3.21.7

Timeline

  • 2026-06-20: disclosed
  • 2026-06-02: patched: Patches released in Nuxt 4.4.7 and 3.21.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.