Unrated severityNVD Advisory· Published Jun 22, 2026
Nuxt - Cross-Site Scripting via navigateTo open Option
CVE-2026-56698
Description
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin when user-controlled input is passed to navigateTo.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032mitrepatch
- github.com/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024dmitrepatch
- github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3mitrevendor-advisory
- www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-navigateto-open-optionmitrethird-party-advisory
News mentions
0No linked articles in our index yet.