The vulnerability stems from Nuxt’s handling of dynamic Vue components. When the configuration option `vue.runtimeCompiler: true` is enabled, a malicious actor can embed a template key inside the payload sent to the `/__nuxt_island/` endpoint. The Nitro server processes this key as a Vue template and executes it, giving the attacker remote code execution capabilities. The flaw is characterized by CWE‑74 and CWE‑94.

Nuxt Framework (Nuxt) versions 3.4.0 through 3.21.9 and 4.5.0 are impacted. These releases from the Nuxt open‑source project enable the vulnerable runtime compiler setting and are fixed by upgrading to Nuxt 3.21.10 or Nuxt 4.5.1 and later.

The CVSS score of 8.1 places this issue in the high‑severity range, indicating a significant risk if exploited. The EPSS score is not available, so the exact probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation at the time of reporting. Attackers would need to send crafted request data to the exposed `/__nuxt_island/` endpoint while the runtime compiler is active, which allows arbitrary code execution on the server.