CVE-2026-71320

HIGH 8.1

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.

CWE	CWE-74 CWE-94
Vendor	nuxt
Product	nuxt
Published	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for nuxt nuxt

Be the first to know when new high vulnerabilities affecting nuxt nuxt are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

nuxt / nuxt

>= 4.0.0, < 4.5.1 >= 3.4.0, < 3.21.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq github.com: https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418 github.com: https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859 github.com: https://github.com/nuxt/nuxt/releases/tag/v3.21.10 github.com: https://github.com/nuxt/nuxt/releases/tag/v4.5.1