CVE-2026-56317 (Medium) detected in nuxt-2.14.3.tgz

[mend-bolt-for-github]

CVE-2026-56317 - Medium Severity Vulnerability

Vulnerable Library - nuxt-2.14.3.tgz

A minimalistic framework for server-rendered Vue.js applications (inspired by Next.js)

Library home page: https://registry.npmjs.org/nuxt/-/nuxt-2.14.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nuxt/package.json

Dependency Hierarchy:

• ❌ nuxt-2.14.3.tgz (Vulnerable Library)

Found in HEAD commit: de1c2b0d1a23367b161c2d995029f9693bd8a155

Found in base branch: master

Vulnerability Details

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.

Publish Date: 2026-06-20

URL: CVE-2026-56317

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m3q2-p4fw-w38m

Release Date: 2026-06-20

Fix Resolution: 3.21.7

---

Step up your Open Source Security Game with Mend here