Nuxt versions 3.4.3 through 3.21.5 and pre‑4.4.6 generate a server‑side HTML redirect when navigateTo() is called with external: true. The redirect body contains a meta refresh tag whose content attribute is populated with the supplied URL after replacing only double quotes with %22. The characters <, >, &, and ' are left uncoded, permitting a malicious payload to break out of the attribute and inject arbitrary HTML or JavaScript. An attacker who can influence the URL passed to navigateTo(url,{external:true}) can therefore execute code in the context of the application, potentially allowing data theft, session hijacking, or defacement. The weakness is a classic reflected XSS scenario as defined by CWE‑83.

The vulnerable Nuxt framework comprises multiple major releases. Products affected include Nuxt 3.4.3 up to (but not including) 3.21.6 and Nuxt 4.0.0‑alpha.1 up to (but not including) 4.4.6. The issue has been patched in any release of Nuxt 3.21.6 or later and 4.4.6 or later.

The CVSS score of 5.3 indicates a moderate impact, and the EPSS score is less than 1% meaning exploitation is not likely but possible. The vulnerability is not present in the CISA KEV catalog. Attacks would likely involve a user clicking a crafted link that calls navigateTo with a malicious URL; an attacker can embed scripting in that URL to execute code under the application origin. No elevated privileges or authentication are required beyond the ability to influence the redirect URL.