Cross-Site Scripting Vulnerability in Nuxt Framework

CVE-2026-56698

What is CVE-2026-56698?

Versions 4.0.0 through 4.4.6 and 3.x prior to 3.21.7 of the Nuxt framework are susceptible to a Cross-Site Scripting vulnerability due to a failure in validating script-capable URLs via the navigateTo open parameter. By exploiting this flaw, an attacker could craft malicious javascript: URLs that, when submitted through user input to the navigateTo function, execute unauthorized JavaScript on the application's domain, compromising its security and potentially leading to data theft or other malicious activities.

References