AI description
Automated description summarized from trusted sources.
CVE-2026-71320 describes a template injection vulnerability affecting Nuxt, an open-source web development framework for Vue.js. Specifically, versions of Nuxt from 3.4.0 up to, but not including, 3.21.10, and versions up to, but not including, 4.5.1 are impacted. An attacker can exploit this by injecting a template key through the `/__nuxt_island/` props into a dynamic component when `vue.runtimeCompiler: true` is enabled. This injection leads to template execution within the Nitro process, potentially allowing for server-side code execution. The issue has been addressed and fixed in Nuxt versions 3.21.10 and 4.5.1.
- Description
- Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.
- Source
- security-advisories@github.com
- NVD status
- Received
CVSS 3.1
- Type
- Secondary
- Base score
- 8.1
- Impact score
- 5.9
- Exploitability score
- 2.2
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security-advisories@github.com
- CWE-74
- Hype score
- Not currently trending