PT-2026-51143

CVE-2026-56317

Published

2026-06-16

Updated

2026-06-24

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.4.7 Nuxt versions prior to 3.21.7

Description A cross-site scripting issue exists in the NoScript component, which writes slot content to innerHTML without proper escaping. This allows attackers to inject malicious scripts via untrusted data in NoScript slots, such as route.query parameters. These scripts execute in the document context when the noscript tag is implicitly closed by script tags.

Recommendations Update to version 4.4.7 or later. Update to version 3.21.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Alcls01111

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers