CVE-2026-46342

Katalog CVE

CVSS 5.4 · Medium EPSS 0,13%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada nuxt, nuxt/nitro-server. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been patched in versions 3.21.6 and 4.4.6.

Rincian

Terbit di NVD

12 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nuxt/nuxt/security/advisories/GHSA-g8wj-3cr3-6w7v mitigasi · patch · advisory vendor
• https://github.com/nuxt/nuxt/pull/35077 issue tracking