PT-2026-115015 · Npm+2 · Nuxt Og Image+1
CVE-2026-102527
·
Published
2026-10-15
·
Updated
2026-10-15
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Nuxt OG Image versions 6.2.5 through 6.6.x
Description
An unauthenticated attacker can perform content spoofing by manipulating the cache of Open Graph images. The dynamic endpoint
/ og/d/*.png accepts unsigned requests, and the resolvePathCacheKey() function generates cache keys using the request path, site URL, and normalized rendering options. By providing attacker-controlled data via the title parameter and a derived cache key, an attacker can populate a cache slot intended for a legitimate image, causing spoofed content to be served to users.Recommendations
Upgrade to version 6.7.2 and configure a secure
secret in the ogImage configuration.
Restrict access to the / og/d/*.png route to minimize the risk of exploitation.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nuxt Og Image
Og-Image