Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Nuxt — GitHub Security Advisory (GHSA-c9cv-mq2m-ppp3) Clear all filters
TI-2026-40878 CVE-2026-56698 · GHSA-h345-75vh-jjwf

Nuxt - Cross-Site Scripting via navigateTo open Option

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00413 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-79
TI-2026-40877 CVE-2026-56697 · GHSA-g898-grjx-8jm3

Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the c…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00337 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-601
TI-2026-40691 CVE-2026-56326 · GHSA-c9cv-mq2m-ppp3

Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00362 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-601