Nuxt, an open‑source framework for Vue.js, includes a flaw that allows an attacker to craft a JavaScript URL beginning with an ASCII C0 control character. When the pages feature is disabled, the no‑pages router treats the value as an internal path before checking the protocol, and passes it to the rendered <a> href. Browsers strip the leading control character and execute the remaining javascript: payload when the user clicks the link, resulting in client‑side code running in the application's origin.

Nuxt (nuxt:nuxt) versions prior to 4.6.0 are vulnerable when the pages option is disabled. Both the default <a> tag output and the custom <NuxtLink> component can render the unsafe href in server‑generated HTML.

The CVSS score of 2.3 indicates limited severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction with the malicious link, characteristic of a local XSS scenario. The code runs in the application's origin, so it can steal data or hijack sessions, but it cannot achieve remote code execution or privilege escalation.