Open Graph Image Spoofing in Nuxt by Nuxt Modules
CVE-2026-102527

6.9MEDIUM

Key Information:

Vendor

Nuxt-modules

Status
Og-image
Vendor
CVE Published:
15 October 2026

What is CVE-2026-102527?

The Nuxt OG Image module for Nuxt applications generates Open Graph images using Vue templates. A flaw exists in versions 6.2.5 to 6.7.0, where the dynamic route /_og/d/*.png inadequately validates requests. This exposes the application to potential exploitation by allowing an unauthenticated attacker to inject manipulated image data via the 'title' parameter. By crafting a specific cacheKey, attackers can craft images that propagate misleading content to legitimate users. This issue has been addressed in version 6.7.0.

Affected Version(s)

og-image >= 6.2.5, < 6.7.0

References

https://github.com/nuxt-modules/og-image/security/advisor...
x_refsource_CONFIRM
https://github.com/nuxt-modules/og-image/pull/638
x_refsource_MISC
https://github.com/nuxt-modules/og-image/commit/e6c5b53ce...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.