Nuxt OG Image renders Open Graph images using Vue templates. Prior to version 6.2.5, the image‑generation route allows an attacker to inject arbitrary attributes into the HTML body through a crafted query string. This enables reflected Cross‑Site Scripting, which can be used to steal session data, deface pages, or execute arbitrary code in the context of the victim browser. The weakness is a classic reflected XSS flaw (CWE‑79).

All installations of the Nuxt OG Image module from nuxt‑modules that use the og-image package and are running a release older than 6.2.5. The vulnerable endpoints are /_og/d/ and, in earlier releases, /og‑image/.

The vulnerability scores a moderate CVSS 6.1 and has a very low EPSS probability of less than 1 %. It is not listed in CISA’s KEV catalog, suggesting no confirmed public exploitation. Attackers can trigger the flaw by sending a specially crafted HTTP request to the exposed endpoints, which then reflects the malicious query into the generated HTML. Even though the impact is limited to the browser context, the ability to drop scripts poses significant threats in compromised user sessions.