CVE-2026-71320

8.1 Élevée

Publiée le 06/08/2026 à 00:17 · Modifiée le 08/09/2026 à 22:51 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.

Traduire en français

Produits concernés

nuxt

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-74
CWE-94

Références

https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418
https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859
https://github.com/nuxt/nuxt/releases/tag/v3.21.10
https://github.com/nuxt/nuxt/releases/tag/v4.5.1
https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories