Executive brief
Nuxt's NoScript component, used to handle content for users with JavaScript disabled, contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through untrusted data. When attackers control content displayed in NoScript slots (such as through URL query parameters), they can execute arbitrary JavaScript in the browser, potentially compromising user sessions and stealing sensitive information.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in Nuxt's NoScript component from @unhead/vue, which writes slot content directly to the innerHTML of the noscript tag without proper HTML escaping. An attacker can inject payloads like <script>alert(1)</script> through untrusted sources (e.g., route.query parameters). When JavaScript is enabled, the HTML parser treats the noscript tag in the head with special parsing rules; a script tag implicitly closes the noscript element and executes in the document context. The attack requires network access and user interaction (a victim visiting a crafted URL), but no authentication. The fix, released in versions 4.4.7 and 3.21.7, escapes slot content using escapeHtml and writes to textContent instead of innerHTML.
Affected products
- Nuxt Nuxt 4.0.0 to <4.4.7; <3.21.7
Timeline
- 2026-06-20: disclosed
- 2026-06-02: patched: Patches released in Nuxt 4.4.7 and 3.21.7