Description
Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .
Published: 2026-10-21
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

The vulnerability arises when the Nuxt server‑island renderer serialises raw input from the `useHeadSafe` API without preserving the safe‑input marker, causing the data to be injected into the page head as ordinary content. This flaw permits an attacker who can supply controlled data to a server‑side component to embed script code or event‑handler attributes, resulting in stored cross‑site scripting across the application, a classic CWE‑79 weakness.

Affected Systems

Nuxt framework. Versions from v3.13.0 through v4.6.2 are affected.

Risk and Exploitability

The CVSS score of 5.4 reflects moderate risk; EPSS is not available and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation. The attack vector is likely through server‑side rendering when attacker‑controlled data is passed to `useHeadSafe` in a .server.vue component or via a NuxtIsland, leading to stored XSS that can be triggered when a user visits the page. The flaw would allow arbitrary script execution within the victim’s browser at the origin of the application.

Generated by OpenCVE AI on October 22, 2026 at 02:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Nuxt to v4.6.2 or later, which includes the fix.
  • If an upgrade is not yet possible, audit all uses of `useHeadSafe` in server‑side components to ensure no unsanitised user input is passed.
  • Implement server‑side input validation or sanitisation prior to calling `useHeadSafe` to prevent malicious data from reaching the head section.

Generated by OpenCVE AI on October 22, 2026 at 02:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-xfq5-w38q-pc2x Nuxt server islands render `useHeadSafe` input without sanitisation
History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Nuxt
Nuxt nuxt
Vendors & Products Nuxt
Nuxt nuxt

Wed, 21 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Description Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .
Title Nuxt server islands render `useHeadSafe` input without sanitisation
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Nuxt Nuxt
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T17:23:40.538Z

Reserved: 2026-10-20T21:53:58.473Z

Link: CVE-2026-114133

cve-icon Vulnrichment

Updated: 2026-10-28T17:23:32.137Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T18:17:26.260

Modified: 2026-10-28T18:17:10.550

Link: CVE-2026-114133

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T11:00:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')