{"id":"CVE-2026-53722","aliases":["CLSA-2026-1784077494","CLSA-2026-1784769506","CLSA-2026-1784769536","CLSA-2026-1784856026","CLSA-2026-1784856198","CLSA-2026-1788286444","CLSA-2026-1792161452","CLSA-2026-1792161455","CLSA-2026-1792161456","CLSA-2026-1792161484","CLSA-2026-1792161592","CLSA-2026-1792161597","CLSA-2026-1792161598","CLSA-2026-1792161814","CLSA-2026-1792161819","CLSA-2026-1792161820","CLSA-2026-1792161927","CLSA-2026-1792161932","CLSA-2026-1792161933","CLSA-2026-1792163456","CLSA-2026-1793661072","EUVD-2026-36428","GHSA-934w-87qh-qr26"],"status":"published","title":"Nuxt: Reflected XSS in `\u003cNuxtLink\u003e` via unsanitised `javascript:` or `data:` URL","description":"Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, \u003cNuxtLink\u003e did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying \u003ca\u003e element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to \u003cNuxtLink :to\u003e or :href, the attacker can supply a javascript: or vbscript: URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt application, resulting in reflected DOM-based cross-site scripting. A data:text/html,... payload reflected through the same sink does not execute in the application's origin but enables a same-tab phishing surface anchored to a legitimate application link. The same value was exposed to consumers of the component's custom slot via the href and route.href props, so applications that re-bind those values to their own anchors were affected identically. This issue has been patched in versions 3.21.7 and 4.4.7.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00293,"percentile":0.22074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-83"],"published":"2026-06-12T13:44:14Z","modified":"2026-11-03T02:45:02Z","fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["4.4.7","3.21.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"nuxt","fixed_in":["4.0.3-tuxcare.5","3.12.3-tuxcare.6","3.2.0-tuxcare.4","2.18.1-tuxcare.3","1.4.5-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/kit","fixed_in":["4.0.3-tuxcare.5","3.12.3-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","fixed_in":["4.0.3-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/schema","fixed_in":["4.0.3-tuxcare.5","3.12.3-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","fixed_in":["4.0.3-tuxcare.5","3.12.3-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","fixed_in":["4.0.3-tuxcare.5","3.12.3-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"nuxi","fixed_in":["3.2.0-tuxcare.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.4.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.21.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.5"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.2","4.0.3-tuxcare.3","4.0.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.6"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.2","3.12.3-tuxcare.3","3.12.3-tuxcare.4","3.12.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.4"}]}],"versions":["3.2.0","3.2.0-tuxcare.1","3.2.0-tuxcare.2","3.2.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.1-tuxcare.0"},{"fixed":"2.18.1-tuxcare.3"}]}],"versions":["2.18.1","2.18.1-tuxcare.1","2.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.5-tuxcare.0"},{"fixed":"1.4.5-tuxcare.3"}]}],"versions":["1.4.5","1.4.5-tuxcare.1","1.4.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.7-tuxcare.0"},{"fixed":"0.10.7-tuxcare.4"}]}],"versions":["0.10.7","0.10.7-tuxcare.1","0.10.7-tuxcare.2","0.10.7-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.5"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.6"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.3","3.12.3-tuxcare.4","3.12.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.4"}]}],"versions":["3.2.0","3.2.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.5"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.5"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.6"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.3","3.12.3-tuxcare.4","3.12.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.4"}]}],"versions":["3.2.0","3.2.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.5"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.6"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.3","3.12.3-tuxcare.4","3.12.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.4"}]}],"versions":["3.2.0","3.2.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.5"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.6"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.3","3.12.3-tuxcare.4","3.12.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.4"}]}],"versions":["3.2.0","3.2.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/test-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.4"}]}],"versions":["3.2.0","3.2.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.4"}]}],"versions":["3.2.0","3.2.0-tuxcare.2"]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.4.7"}]}]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.21.7"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"nuxt","product":"nuxt"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/commit/0103ce06fbbbdfa079a7f020ef8ce00121eac4a3","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/nuxt/nuxt/commit/53284043dc21210a25d629d1cec67d3ae557ffd0","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53722","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-934w-87qh-qr26"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53722.json","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-53722","title":"Nuxt: Reflected XSS in `\u003cNuxtLink\u003e` via unsanitised `javascript:` or `data:` URL","description":"Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, \u003cNuxtLink\u003e did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying \u003ca\u003e element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to \u003cNuxtLink :to\u003e or :href, the attacker can supply a javascript: or vbscript: URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt application, resulting in reflected DOM-based cross-site scripting. A data:text/html,... payload reflected through the same sink does not execute in the application's origin but enables a same-tab phishing surface anchored to a legitimate application link. The same value was exposed to consumers of the component's custom slot via the href and route.href props, so applications that re-bind those values to their own anchors were affected identically. This issue has been patched in versions 3.21.7 and 4.4.7.","status":"published","published":"2026-06-12T13:44:14.592Z","modified":"2026-06-12T15:05:46.393Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79","CWE-83"],"updated_at":"2026-11-02T14:19:59.761005Z"}],"euvd":[{"id":"EUVD-2026-36428","description":"Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, \u003cNuxtLink\u003e did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying \u003ca\u003e element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to \u003cNuxtLink :to\u003e or :href, the attacker can supply a javascript: or vbscript: URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt application, resulting in reflected DOM-based cross-site scripting. A data:text/html,... payload reflected through the same sink does not execute in the application's origin but enables a same-tab phishing surface anchored to a legitimate application link. The same value was exposed to consumers of the component's custom slot via the href and route.href props, so applications that re-bind those values to their own anchors were affected identically. This issue has been patched in versions 3.21.7 and 4.4.7.","status":"published","published":"2026-06-12T13:44:14Z","modified":"2026-06-12T15:05:46Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:43.577088Z"}],"ghsa":[{"id":"GHSA-934w-87qh-qr26","title":"Nuxt: Reflected XSS in `\u003cNuxtLink\u003e` via unsanitised `javascript:` or `data:` URL","description":"### Summary\n\n`\u003cNuxtLink\u003e` did not validate the URL scheme of values bound to its `to` or `href` props before rendering them into the `href` attribute of the underlying `\u003ca\u003e` element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to `\u003cNuxtLink :to\u003e` or `:href`, the attacker can supply a `javascript:` or `vbscript:` URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt application, resulting in reflected DOM-based cross-site scripting. A `data:text/html,...` payload reflected through the same sink does not execute in the application's origin but enables a same-tab phishing surface anchored to a legitimate application link.\n\nThe same value was exposed to consumers of the component's `custom` slot via the `href` and `route.href` props, so applications that re-bind those values to their own anchors were affected identically.\n\nUnlike the previously reported `navigateTo` issue (CVE-2024-34343), the sink here is the rendered anchor itself; the existing `isScriptProtocol` checks in `navigateTo` and `reloadNuxtApp` are not on the code path. The `onClick` handler intentionally returns early for external links so the browser's native protocol-based navigation runs.\n\n### Affected component\n\n- File: `packages/nuxt/src/app/components/nuxt-link.ts`\n- Sink: `h('a', { href: href.value, ... })` in the default render, plus the `href` / `route.href` props passed to the `custom` slot.\n- Broken check: external auto-detection treated any `hasProtocol(path, { acceptRelative: true })` value as an \"external link\", then rendered the value directly as `\u003ca href\u003e` without rejecting script-capable protocols. There was no equivalent of the `navigateTo` `isScriptProtocol(protocol)` gate in this path.\n\n### Impact\n\nAny Nuxt application that binds user-controlled values to `\u003cNuxtLink :to\u003e` / `:href` was vulnerable. Common shapes: profile-link rendering (`\u003cNuxtLink :to=\"user.website\"\u003e`), \"share this\" / \"open in new tab\" handlers that pass through a query parameter, CMS-driven landing pages that render `\u003cNuxtLink :to=\"cms.cta.url\"\u003e`, and marketplace listings that show seller-supplied links.\n\nFor `javascript:` / `vbscript:` the primitive is reflected XSS in the application's first-party origin (session theft for non-`HttpOnly` cookies, CSRF token theft, account takeover via DOM rewriting, credential harvesting via fake login overlays). For `data:text/html,...` the attacker gets a same-tab phishing surface anchored to a legitimate application link.\n\n### Patches\n\nFixed in `nuxt@4.4.7` (commit [`0103ce06`](https://github.com/nuxt/nuxt/commit/0103ce06fbbbdfa079a7f020ef8ce00121eac4a3)) and backported to `nuxt@3.21.7` (commit [`53284043`](https://github.com/nuxt/nuxt/commit/53284043dc21210a25d629d1cec67d3ae557ffd0)). The fix sanitises the resolved external `href` before it is passed to `\u003ca\u003e` or the `custom` slot: control characters and whitespace are stripped, leading `view-source:` prefixes are unwrapped, and any remaining script-capable scheme (per `isScriptProtocol`) causes the `href` to be replaced with an empty string.\n\n### Workarounds\n\nUntil you can upgrade, validate URLs at the source before binding them to `\u003cNuxtLink :to\u003e` / `:href`. For example, only accept paths that start with `/` (and not `//`), or run user-supplied URLs through `new URL(value)` and reject anything whose `protocol` is not in an allow-list (typically `http:` and `https:`).","status":"published","published":"2026-06-16T13:49:36Z","modified":"2026-08-14T18:45:57Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79","CWE-83"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-53722","description":"Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, \u003cNuxtLink\u003e did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying \u003ca\u003e element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to \u003cNuxtLink :to\u003e or :href, the attacker can supply a javascript: or vbscript: URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt application, resulting in reflected DOM-based cross-site scripting. A data:text/html,... payload reflected through the same sink does not execute in the application's origin but enables a same-tab phishing surface anchored to a legitimate application link. The same value was exposed to consumers of the component's custom slot via the href and route.href props, so applications that re-bind those values to their own anchors were affected identically. This issue has been patched in versions 3.21.7 and 4.4.7.","status":"published","published":"2026-06-12T15:16:31.427Z","modified":"2026-06-17T10:58:00.153Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79","CWE-83"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"CVE-2026-53722","title":"Nuxt: Reflected XSS in `\u003cNuxtLink\u003e` via unsanitised `javascript:` or `data:` URL","description":"Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, \u003cNuxtLink\u003e did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying \u003ca\u003e element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to \u003cNuxtLink :to\u003e or :href, the attacker can supply a javascript: or vbscript: URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt application, resulting in reflected DOM-based cross-site scripting. A data:text/html,... payload reflected through the same sink does not execute in the application's origin but enables a same-tab phishing surface anchored to a legitimate application link. The same value was exposed to consumers of the component's custom slot via the href and route.href props, so applications that re-bind those values to their own anchors were affected identically. This issue has been patched in versions 3.21.7 and 4.4.7.","status":"published","published":"2026-06-12T13:44:14.592Z","modified":"2026-10-28T02:31:08.455319972Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79","CWE-83"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"GHSA-934w-87qh-qr26","title":"Nuxt: Reflected XSS in `\u003cNuxtLink\u003e` via unsanitised `javascript:` or `data:` URL","description":"### Summary\n\n`\u003cNuxtLink\u003e` did not validate the URL scheme of values bound to its `to` or `href` props before rendering them into the `href` attribute of the underlying `\u003ca\u003e` element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to `\u003cNuxtLink :to\u003e` or `:href`, the attacker can supply a `javascript:` or `vbscript:` URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt application, resulting in reflected DOM-based cross-site scripting. A `data:text/html,...` payload reflected through the same sink does not execute in the application's origin but enables a same-tab phishing surface anchored to a legitimate application link.\n\nThe same value was exposed to consumers of the component's `custom` slot via the `href` and `route.href` props, so applications that re-bind those values to their own anchors were affected identically.\n\nUnlike the previously reported `navigateTo` issue (CVE-2024-34343), the sink here is the rendered anchor itself; the existing `isScriptProtocol` checks in `navigateTo` and `reloadNuxtApp` are not on the code path. The `onClick` handler intentionally returns early for external links so the browser's native protocol-based navigation runs.\n\n### Affected component\n\n- File: `packages/nuxt/src/app/components/nuxt-link.ts`\n- Sink: `h('a', { href: href.value, ... })` in the default render, plus the `href` / `route.href` props passed to the `custom` slot.\n- Broken check: external auto-detection treated any `hasProtocol(path, { acceptRelative: true })` value as an \"external link\", then rendered the value directly as `\u003ca href\u003e` without rejecting script-capable protocols. There was no equivalent of the `navigateTo` `isScriptProtocol(protocol)` gate in this path.\n\n### Impact\n\nAny Nuxt application that binds user-controlled values to `\u003cNuxtLink :to\u003e` / `:href` was vulnerable. Common shapes: profile-link rendering (`\u003cNuxtLink :to=\"user.website\"\u003e`), \"share this\" / \"open in new tab\" handlers that pass through a query parameter, CMS-driven landing pages that render `\u003cNuxtLink :to=\"cms.cta.url\"\u003e`, and marketplace listings that show seller-supplied links.\n\nFor `javascript:` / `vbscript:` the primitive is reflected XSS in the application's first-party origin (session theft for non-`HttpOnly` cookies, CSRF token theft, account takeover via DOM rewriting, credential harvesting via fake login overlays). For `data:text/html,...` the attacker gets a same-tab phishing surface anchored to a legitimate application link.\n\n### Patches\n\nFixed in `nuxt@4.4.7` (commit [`0103ce06`](https://github.com/nuxt/nuxt/commit/0103ce06fbbbdfa079a7f020ef8ce00121eac4a3)) and backported to `nuxt@3.21.7` (commit [`53284043`](https://github.com/nuxt/nuxt/commit/53284043dc21210a25d629d1cec67d3ae557ffd0)). The fix sanitises the resolved external `href` before it is passed to `\u003ca\u003e` or the `custom` slot: control characters and whitespace are stripped, leading `view-source:` prefixes are unwrapped, and any remaining script-capable scheme (per `isScriptProtocol`) causes the `href` to be replaced with an empty string.\n\n### Workarounds\n\nUntil you can upgrade, validate URLs at the source before binding them to `\u003cNuxtLink :to\u003e` / `:href`. For example, only accept paths that start with `/` (and not `//`), or run user-supplied URLs through `new URL(value)` and reject anything whose `protocol` is not in an allow-list (typically `http:` and `https:`).","status":"published","published":"2026-06-16T13:49:36Z","modified":"2026-08-14T19:00:07.654547013Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79","CWE-83"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"CLSA-2026-1784077494","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 4.0.3-tuxcare.5.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:47:35.023861357Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784769506","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.3-tuxcare.6.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.668752485Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769536","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.2.0-tuxcare.4.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-30T19:46:03.471734923Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856026","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 2.18.1-tuxcare.3.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-30T19:46:03.44590934Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856198","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 1.4.5-tuxcare.3.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.868061353Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1788286444","title":"TuxCare security update for nuxt (2 CVEs)","description":"TuxCare rebuilt nuxt to address 2 CVEs. Fixed in 0.10.7-tuxcare.4.","status":"published","published":"2026-09-01T18:14:04Z","modified":"2026-10-15T09:47:55.450495075Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792161452","title":"TuxCare security update for @nuxt/kit (1 CVE)","description":"TuxCare rebuilt @nuxt/kit to address 1 CVE. Fixed in 4.0.3-tuxcare.5.","status":"published","published":"2026-10-16T14:37:32Z","modified":"2026-10-16T16:31:02.669042251Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161455","title":"TuxCare security update for @nuxt/kit (1 CVE)","description":"TuxCare rebuilt @nuxt/kit to address 1 CVE. Fixed in 3.12.3-tuxcare.6.","status":"published","published":"2026-10-16T14:37:35Z","modified":"2026-10-16T16:31:02.919076376Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161456","title":"TuxCare security update for @nuxt/kit (2 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 2 CVEs. Fixed in 3.2.0-tuxcare.4.","status":"published","published":"2026-10-16T14:37:36Z","modified":"2026-10-16T16:31:03.077267533Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161484","title":"TuxCare security update for @nuxt/rspack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/rspack-builder to address 1 CVE. Fixed in 4.0.3-tuxcare.5.","status":"published","published":"2026-10-16T14:38:04Z","modified":"2026-10-16T16:31:03.835433766Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161592","title":"TuxCare security update for @nuxt/schema (1 CVE)","description":"TuxCare rebuilt @nuxt/schema to address 1 CVE. Fixed in 4.0.3-tuxcare.5.","status":"published","published":"2026-10-16T14:39:52Z","modified":"2026-10-16T16:31:05.509112832Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161597","title":"TuxCare security update for @nuxt/schema (1 CVE)","description":"TuxCare rebuilt @nuxt/schema to address 1 CVE. Fixed in 3.12.3-tuxcare.6.","status":"published","published":"2026-10-16T14:39:57Z","modified":"2026-10-16T16:31:05.862958174Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161598","title":"TuxCare security update for @nuxt/schema (2 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 2 CVEs. Fixed in 3.2.0-tuxcare.4.","status":"published","published":"2026-10-16T14:39:58Z","modified":"2026-10-16T16:31:05.865063086Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161814","title":"TuxCare security update for @nuxt/vite-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/vite-builder to address 1 CVE. Fixed in 4.0.3-tuxcare.5.","status":"published","published":"2026-10-16T14:43:34Z","modified":"2026-10-16T16:30:33.701196347Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161819","title":"TuxCare security update for @nuxt/vite-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/vite-builder to address 1 CVE. Fixed in 3.12.3-tuxcare.6.","status":"published","published":"2026-10-16T14:43:39Z","modified":"2026-10-16T16:30:34.588147781Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161820","title":"TuxCare security update for @nuxt/vite-builder (2 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 2 CVEs. Fixed in 3.2.0-tuxcare.4.","status":"published","published":"2026-10-16T14:43:40Z","modified":"2026-10-16T16:30:34.582746648Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161927","title":"TuxCare security update for @nuxt/webpack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 4.0.3-tuxcare.5.","status":"published","published":"2026-10-16T14:45:27Z","modified":"2026-10-16T16:31:18.948710351Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161932","title":"TuxCare security update for @nuxt/webpack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 3.12.3-tuxcare.6.","status":"published","published":"2026-10-16T14:45:32Z","modified":"2026-10-16T16:31:30.282776893Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161933","title":"TuxCare security update for @nuxt/webpack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 3.2.0-tuxcare.4.","status":"published","published":"2026-10-16T14:45:33Z","modified":"2026-11-10T19:45:18.684943697Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792163456","title":"TuxCare security update for @nuxt/test-utils (2 CVEs)","description":"TuxCare rebuilt @nuxt/test-utils to address 2 CVEs. Fixed in 3.2.0-tuxcare.4.","status":"published","published":"2026-10-16T15:10:56Z","modified":"2026-10-16T16:31:44.837826008Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1793661072","title":"TuxCare security update for nuxi (1 CVE)","description":"TuxCare rebuilt nuxi to address 1 CVE. Fixed in 3.2.0-tuxcare.4.","status":"published","published":"2026-11-03T00:11:13Z","modified":"2026-11-03T02:45:02.353672033Z","updated_at":"2026-11-03T03:05:43.703218Z"}]}}