Nuxt <NuxtLink> components failed to validate the URL scheme of values bound to to or href props before rendering them into the underlying <a> element. As a result, an attacker who can control the input that is bound—such as through a query parameter, CMS field, or user‑supplied profile URL—can embed a javascript: or vbscript: URL that is reflected verbatim into the page. Activating that link executes the script in the application origin, allowing execution of arbitrary code on the client side. A data:text/html payload is also reflected and, while it does not execute in the origin, it creates a same‑tab phishing surface that can be used for social engineering attacks. The vulnerability also extends to values exposed via the component’s custom slot, meaning that applications that rebinding those values to their own anchors are equally affected.

This issue affects all Nuxt versions prior to 3.21.7 and 4.4.7 for the nuxt:nuxt product. Users running those older releases are exposed to reflected DOM‑based XSS through unsanitised URLs in <NuxtLink> components.

The CVSS score of 5.1 indicates a medium severity vulnerability. The EPSS score is reported as less than 1 %, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so there is no known widespread exploitation. Attackers would need to place malicious input into a field that is later bound to a <NuxtLink>, so the likely attack vector is through crafted URLs or user-supplied content that the application reflects. If exploited, an attacker could run scripts in the application’s origin, potentially compromising user data or session tokens, or create a phishing surface within the same tab.