CVE-2026-56698

MEDIUM

Nuxt - Cross-Site Scripting via navigateTo open Option

Title source: cna

Description

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin when user-controlled input is passed to navigateTo.

References (4)

Core 4

Core References

Vendor Advisory vendor-advisory

GitHub Security Advisory (GHSA-c9cv-mq2m-ppp3)

https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3

Patch patch

https://github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032

View Patch ZIP pw:eip

Patch patch

https://github.com/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024d

View Patch ZIP pw:eip

Third Party Advisory third-party-advisory

VulnCheck Advisory: Nuxt - Cross-Site Scripting via navigateTo open Option

https://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-navigateto-open-option

Scores

CVSS v3 6.1

EPSS 0.0041

EPSS Percentile 34.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (5)

Nuxt/Nuxt < 3.21.7

nuxt/nuxt 3.0.0 - 3.21.7

Nuxt/Nuxt 3.21.7

Nuxt/Nuxt 4.0.0 - 4.4.7

Nuxt/Nuxt 4.4.7

Published Jun 22, 2026

Tracked Since Jun 23, 2026