Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

18 records

Vendor: nuxt Component: Nuxt Clear all filters
TI-2026-40666 CVE-2026-56301 · GHSA-534h-c3cw-v3h9

Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Priority LOW 29

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing loc…

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00149 Published 2026-06-23 Fixed in 4.4.7, 3.21.7 CWE-276
TI-2026-40878 CVE-2026-56698 · GHSA-h345-75vh-jjwf

Nuxt - Cross-Site Scripting via navigateTo open Option

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00413 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-79
TI-2026-40877 CVE-2026-56697 · GHSA-g898-grjx-8jm3

Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the c…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00337 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-601
TI-2026-40691 CVE-2026-56326 · GHSA-c9cv-mq2m-ppp3

Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00362 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-601
TI-2026-40682 CVE-2026-56317 · GHSA-m3q2-p4fw-w38m

Nuxt - Cross-Site Scripting via NoScript Component Slot Content

Priority LOW 12

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00342 Published 2026-06-20 Fixed in 4.4.7, 3.21.7 CWE-79
TI-2024-28339 CVE-2024-42352 · GHSA-cxgv-px37-4mp2

Server-Side Request Forgery (SSRF) in nuxt-icon

Priority HIGH 76

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00648 Published 2024-08-05 Fixed in 1.4.5 CWE-918
TI-2024-15676 CVE-2024-23657 · GHSA-rcvg-rgf7-pppv

Path Traversal: '../filedir' in Nuxt Devtools

Priority MEDIUM 42

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01212 Published 2024-08-05 Fixed in 1.3.9 CWE-22
TI-2023-03020 CVE-2023-3224 · GHSA-gc34-5v43-h7v8

Code Injection in nuxt/nuxt

Priority HIGH 77

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.58648 Published 2023-06-13 Fixed in 3.5.3, 3.4.3 CWE-94