Nuxt, the Vue.js web framework, has a flaw that lets an attacker specify a top‑level "as" property on the /__nuxt_island/ endpoint. This value is fed directly into Vue’s dynamic component resolution via <component :is>, resolveDynamicComponent, or the h() helper, bypassing normal validation. The vulnerability is an instance of CWE‑20 (Improper Input Validation) and enables the loading of any component at the requester's discretion, which can lead to client‑side code execution or cross‑site scripting when the component performs dangerous operations.

Versions of Nuxt from 3.1.0 through 3.21.10 and from the initial release up to 4.5.1 are susceptible. Upgrading to 3.21.10 or 4.5.1 (or later) removes the "as" prop handling that allows arbitrary component instantiation.

The CVSS score is 4.8, indicating a moderate severity. EPSS is not published and the flaw is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. The flaw can be triggered via an unauthenticated HTTP request to the /__nuxt_island/ endpoint, so any user who can reach the application can supply a malicious "as" value. Exploitation requires knowledge of component names that are exposed in the application. Once a component is instantiated, any embedded script execution path can run in the client’s browser, potentially leading to information disclosure or XSS scenarios.