CVE-2026-56698

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.x prior to 3.21.7 Nuxt versions 4.0.0 through 4.4.6

Description Nuxt fails to validate script-capable URLs in the navigateTo open option, which allows for client-side script execution. When user-controlled input is passed to navigateTo, attackers can provide javascript: URLs through the open parameter to execute arbitrary scripts within the application's origin.

Recommendations Update versions 3.x to 3.21.7 or later. Update versions 4.0.0 through 4.4.6 to 4.4.7 or later.