Reflected DOM-based Cross-Site Scripting in Nuxt Framework
CVE-2026-53722
What is CVE-2026-53722?
The Nuxt framework, designed for web development using Vue.js, has a vulnerability where the component fails to validate the URL scheme of values assigned to its 'to' or 'href' properties. This oversight can lead to the execution of arbitrary scripts when malicious input is bound to these properties. Attackers can exploit this flaw by inputting javascript: or vbscript: URLs, causing these scripts to execute within the context of the Nuxt application upon user interaction. Additionally, a data:text/html payload can create a phishing risk via legitimate application links. This vulnerability affects not only the direct links but also those re-bound through the component's custom slot interface. Nuxt has addressed this issue in versions 3.21.7 and 4.4.7.
Affected Version(s)
nuxt < 3.21.7 < 3.21.7
nuxt >= 4.0.0, < 4.4.7 < 4.0.0, 4.4.7