Read the docs

nuxt

Records45All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

nuxt records in CISA KEV

No nuxt vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nuxt 18 records HIGH Framework 2 records HIGH Nuxt/nitro-server 2 records HIGH Nuxt/rspack-builder 2 records MEDIUM Nuxt/webpack-builder 2 records MEDIUM Og Image 2 records HIGH Devtools 1 record LOW

Records

18 records in Nuxt · all components

TI-2023-03020 CVE-2023-3224 · GHSA-gc34-5v43-h7v8

Code Injection in nuxt/nuxt

Priority HIGH 77

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.58648 Published 2023-06-13 Fixed in 3.5.3, 3.4.3 CWE-94
TI-2024-28339 CVE-2024-42352 · GHSA-cxgv-px37-4mp2

Server-Side Request Forgery (SSRF) in nuxt-icon

Priority HIGH 76

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00648 Published 2024-08-05 Fixed in 1.4.5 CWE-918
TI-2024-15676 CVE-2024-23657 · GHSA-rcvg-rgf7-pppv

Path Traversal: '../filedir' in Nuxt Devtools

Priority MEDIUM 42

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01212 Published 2024-08-05 Fixed in 1.3.9 CWE-22
TI-2026-40666 CVE-2026-56301 · GHSA-534h-c3cw-v3h9

Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Priority LOW 29

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing loc…

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00149 Published 2026-06-23 Fixed in 4.4.7, 3.21.7 CWE-276
TI-2026-40878 CVE-2026-56698 · GHSA-h345-75vh-jjwf

Nuxt - Cross-Site Scripting via navigateTo open Option

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00413 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-79
TI-2026-40877 CVE-2026-56697 · GHSA-g898-grjx-8jm3

Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the c…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00337 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-601
TI-2026-40691 CVE-2026-56326 · GHSA-c9cv-mq2m-ppp3

Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00362 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-601
TI-2026-40682 CVE-2026-56317 · GHSA-m3q2-p4fw-w38m

Nuxt - Cross-Site Scripting via NoScript Component Slot Content

Priority LOW 12

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00342 Published 2026-06-20 Fixed in 4.4.7, 3.21.7 CWE-79
Open these records in search →