PT-2026-51417

CVE-2026-56698

Published

2026-06-16

Updated

2026-06-23

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.x prior to 3.21.7 Nuxt versions 4.0.0 through 4.4.6

Description Nuxt fails to validate script-capable URLs in the navigateTo open option, which allows for client-side script execution. When user-controlled input is passed to navigateTo, attackers can provide javascript: URLs through the open parameter to execute arbitrary scripts within the application's origin.

Recommendations Update versions 3.x to 3.21.7 or later. Update versions 4.0.0 through 4.4.6 to 4.4.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Alcls01111

Vendors

Affected products

Weakness enumeration

CWE-601: URL Redirection to Untrusted Site (\'Open Redirect\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')