Read the docs
TI-2026-26690 Aliases CVE-2026-34405GHSA-mg36-wvcr-m75h

Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in version 6.2.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00224 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed og-image (nuxt-modules): 6.2.5nuxt-og-image (npm): 6.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxt-modulesog-imagebefore 6.2.56.2.5Patch availableCNA
—nuxt-og-image (npm)before 6.2.56.2.5Patch availableGHSA-mg36-wvcr-m75h
  • og-image Vendornuxt-modules Affected before 6.2.5 Fixed in 6.2.5 Patch available CNA
  • nuxt-og-image (npm) Vendor— Affected before 6.2.5 Fixed in 6.2.5 Patch available GHSA-mg36-wvcr-m75h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:og_image:*:*:*:*:*:node.js:*:*before 6.2.5Vulnerablenuxt
  • cpe:2.3:a:nuxt:og_image:*:*:*:*:*:node.js:*:* Versions before 6.2.5 Vulnerable ·nuxt

Remediation

  • Fix · CNA og-image (nuxt-modules) Fixed in 6.2.5
  • Fix · GHSA-mg36-wvcr-m75h nuxt-og-image (npm) Fixed in 6.2.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34405
  2. 2026-10-03 Alias added: GHSA-mg36-wvcr-m75h

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-18659 Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc CVSS 3.1CRITICAL 9.3
  • TI-2025-33918 mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4) CVSS 3.1HIGH 8.3
  • TI-2026-44231 Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter CVSS 4.0MEDIUM 6.9
  • TI-2026-74652 Cache poisoning in Nuxt OG Image via unsigned image routes CVSS 4.0MEDIUM 6.9
  • TI-2026-32501 nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences