CVE-2026-71320

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Published Aug 5, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.

Analysis

Technical impact

The vulnerability stems from Nuxt’s handling of dynamic Vue components. When the configuration option `vue.runtimeCompiler: true` is enabled, a malicious actor can embed a template key inside the payload sent to the `/__nuxt_island/` endpoint. The Nitro server processes this key as a Vue template and executes it, giving the attacker remote code execution capabilities. The flaw is characterized by CWE‑74 and CWE‑94.

Affected Systems

Nuxt Framework (Nuxt) versions 3.4.0 through 3.21.9 and 4.5.0 are impacted. These releases from the Nuxt open‑source project enable the vulnerable runtime compiler setting and are fixed by upgrading to Nuxt 3.21.10 or Nuxt 4.5.1 and later.

Risk and Exploitability

The CVSS score of 8.1 places this issue in the high‑severity range, indicating a significant risk if exploited. The EPSS score is not available, so the exact probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation at the time of reporting. Attackers would need to send crafted request data to the exposed `/__nuxt_island/` endpoint while the runtime compiler is active, which allows arbitrary code execution on the server.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

nuxt

affected

Version	Status	Constraints
`>= 4.0.0, < 4.5.1`	affected	—
`>= 3.4.0, < 3.21.10`	affected	—

No data.

Vendor Product Versions

Nuxt

Version	Status	Scheme	Platform
`[4.0.0,4.5.1)`	affected	semver	—
`[3.4.0,3.21.10)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Nuxt 3.21.10 or later, or Nuxt 4.5.1 or later, which contain the fix for runtime template injection.
If an immediate upgrade is not possible, set the `vue.runtimeCompiler` configuration option to `false` to disable runtime template compilation and remove the injection vector.
Restrict and authenticate access to the `/__nuxt_island/` endpoint and audit third‑party plugins that may enable runtime compiler functionality.

Generated by OpenCVE AI on August 5, 2026 at 22:50 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-9473-5f9j-94wq	Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.710% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418
https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859
https://github.com/nuxt/nuxt/releases/tag/v3.21.10
https://github.com/nuxt/nuxt/releases/tag/v4.5.1
https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq

History

Aug 6, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 5, 2026 10:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Nuxt Nuxt nuxt
Vendors & Products		Nuxt Nuxt nuxt

Aug 5, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.
Title		Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
Weaknesses		CWE-74 CWE-94
References		https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418 https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859 https://github.com/nuxt/nuxt/releases/tag/v3.21.10 https://github.com/nuxt/nuxt/releases/tag/v4.5.1 https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

Nuxt Nuxt

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94
Improper Control of Generation of Code ('Code Injection')