The vulnerability resides in the NoScript component of Nuxt, where content supplied to a component slot is written directly to innerHTML without any escaping. An attacker can inject malicious HTML or script fragments into untrusted data that reaches the slot—for example, via query parameters. When the noscript tag is closed by injected script tags, the payload runs with the privileges of the web page, potentially stealing cookies, session data, or performing actions on behalf of the user.

Nuxt users running the community edition of Nuxt before version 4.4.7 or any 3.x release prior to 3.21.7 are susceptible. These versions are contained on the Nuxt CPE namespace associated with node.js deployments. Updated releases above these thresholds include the patch that properly escapes slot content.

The CVSS score of 2.3 reflects only a low‑severity impact; the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires that an attacker can craft a request containing malicious content that ends up in a NoScript slot, which is a typical web‑attack scenario. Given the low score, the likelihood of widespread exploitation is low, but the potential for an XSS attack remains if the application accepts user input into the NoScript slot.