CVE-2026-71320
- Source
- https://cve.org/CVERecord?id=CVE-2026-71320
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71320.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-71320
- Aliases
- Downstream
- Published
- 2026-08-05T21:29:51Z
- Modified
- 2026-10-28T02:30:44Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
- Details
-
Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when
vue.runtimeCompiler: trueis enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-74", "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71320.json" }- References
-
- https://github.com/nuxt/nuxt/releases/tag/v3.21.10
- https://github.com/nuxt/nuxt/releases/tag/v4.5.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71320.json
- https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq
- https://nvd.nist.gov/vuln/detail/CVE-2026-71320
- https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418
- https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859
Affected packages
Git / github.com/nuxt/nuxt
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nuxt/nuxt
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "4.0.0" }, { "fixed": "4.5.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "3.4.0" }, { "fixed": "3.21.10" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "5b60017f7f1d5e9384cadf1d6c580b99d583c418" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "ee6c846338f4eb75801815dda86df1f494725859" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v3.21.10", "range": [ { "fixed": "deafc94128005346ed8ef4dd5e64f940d80377d3" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v4.5.1", "range": [ { "fixed": "452dd50d92ccdf6f456b500e71d0f26baaeff796" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v3.*
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.11.0
v3.11.1
v3.11.2
v3.12.0
v3.12.1
v3.12.2
v3.12.3
v3.12.4
v3.13.0
v3.13.1
v3.13.2
v3.14.0
v3.14.159
v3.14.1592
v3.15.0
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.16.0
v3.16.1
v3.16.2
v3.17.0
v3.17.1
v3.17.2
v3.17.3
v3.17.4
v3.17.5
v3.17.6
v3.17.7
v3.18.0
v3.18.1
v3.19.0
v3.19.1
v3.19.2
v3.19.3
v3.20.0
v3.20.1
v3.20.2
v3.21.0
v3.21.1
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.8.0
v3.8.1
v3.8.2
v3.9.0
v3.9.1
v3.9.2
v3.9.3
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.5.0