Medium severity · published Jun 20, 2026
CVE-2026-56317
Nuxt - Cross-Site Scripting via NoScript Component Slot Content
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NU
Nuxt · Nuxt
4.0.0 before 4.4.7; before 3.21.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56317
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56317
Patch
https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e
Patch
https://github.com/nuxt/nuxt/commit/7fea9fd687f1dacbfb63db5fae5839896b017a0e
Mitigation
https://github.com/nuxt/nuxt/security/advisories/GHSA-m3q2-p4fw-w38m
Patch
https://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-noscript-component-slot-content
More from Nuxt
9.8
CVE-2023-3224
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3
8.8
CVE-2024-34344
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js
8.8
CVE-2024-23657
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js
8.2
CVE-2026-71315
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
8.2
CVE-2026-53721
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher