Read the docs
TI-2022-04036 Aliases CVE-2022-4413GHSA-w9pr-59v3-7rgc

Cross-site Scripting (XSS) - Reflected in nuxt/framework

Priority HIGH 68CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00544 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nuxt/framework (nuxt): v3.0.0-rc.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxtnuxt/frameworkbefore v3.0.0-rc.13v3.0.0-rc.13Patch availableCNA
  • nuxt/framework Vendornuxt Affected before v3.0.0-rc.13 Fixed in v3.0.0-rc.13 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:framework:3.0.0:rc1:*:*:*:*:*:*3.0.0 rc1Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc10:*:*:*:*:*:*3.0.0 rc10Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc11:*:*:*:*:*:*3.0.0 rc11Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc12:*:*:*:*:*:*3.0.0 rc12Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc2:*:*:*:*:*:*3.0.0 rc2Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc3:*:*:*:*:*:*3.0.0 rc3Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc4:*:*:*:*:*:*3.0.0 rc4Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc5:*:*:*:*:*:*3.0.0 rc5Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc6:*:*:*:*:*:*3.0.0 rc6Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc7:*:*:*:*:*:*3.0.0 rc7Vulnerablenuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc1:*:*:*:*:*:* Versions 3.0.0 rc1 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc10:*:*:*:*:*:* Versions 3.0.0 rc10 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc11:*:*:*:*:*:* Versions 3.0.0 rc11 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc12:*:*:*:*:*:* Versions 3.0.0 rc12 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc2:*:*:*:*:*:* Versions 3.0.0 rc2 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc3:*:*:*:*:*:* Versions 3.0.0 rc3 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc4:*:*:*:*:*:* Versions 3.0.0 rc4 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc5:*:*:*:*:*:* Versions 3.0.0 rc5 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc6:*:*:*:*:*:* Versions 3.0.0 rc6 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc7:*:*:*:*:*:* Versions 3.0.0 rc7 Vulnerable ·nuxt
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nuxt:framework:3.0.0:rc8:*:*:*:*:*:*3.0.0 rc8Vulnerablenuxt
cpe:2.3:a:nuxt:framework:3.0.0:rc9:*:*:*:*:*:*3.0.0 rc9Vulnerablenuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc8:*:*:*:*:*:* Versions 3.0.0 rc8 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:framework:3.0.0:rc9:*:*:*:*:*:* Versions 3.0.0 rc9 Vulnerable ·nuxt

Remediation

  • Fix · CNA nuxt/framework (nuxt) Fixed in v3.0.0-rc.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    nuxt/framework v3.0.0-rc.13

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2022-04037 Cross-site Scripting (XSS) - DOM in nuxt/frameworkPriority HIGH 68
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4413
  2. 2026-10-03 Alias added: GHSA-w9pr-59v3-7rgc

References

Exploit 1

Patch 1

  • TI-2022-04037 Cross-site Scripting (XSS) - DOM in nuxt/framework CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences