Description
Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nuxt nuxt
>= 4.0.0, < 4.5.1affected>= 3.4.0, < 3.21.10affected
References
- https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq ↗
- https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418 ↗
- https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859 ↗
- https://github.com/nuxt/nuxt/releases/tag/v3.21.10 ↗
- https://github.com/nuxt/nuxt/releases/tag/v4.5.1 ↗