Stored Cross-Site Scripting Vulnerability in Nuxt Framework
CVE-2026-114133

5.4MEDIUM

Key Information:

Vendor

Nuxt

Status
Nuxt
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114133?

The Nuxt framework, a popular open-source web development tool for Vue.js, contains a vulnerability that affects versions from 3.13.0 to 4.6.2. This issue arises when the server-island renderer improperly serializes raw input for the useHeadSafe function, failing to maintain the safe-input marker. As a result, attacker-controlled data can be inserted into the page head, potentially leading to stored cross-site scripting (XSS) attacks. These attacks may allow for the execution of malicious scripts or attributes in the application origin. Users of the affected versions are urged to upgrade to version 4.6.2, where this vulnerability has been addressed.

Affected Version(s)

nuxt >= 3.13.0, < 4.6.2

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq...
x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/493565e99451a0f52330b...
x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v4.6.2
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.