Approved changes feed: RSS · Atom
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:node.js:*:*
part: a version: * update: *
| Vendor | Nuxt (54f49c10-5fda-5738-9871-ec26d94a08d8) |
|---|---|
| Product | Nuxt (5b55323d-fc0c-5874-bb14-629f454b69a4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-56317 |
vulnerable | 2026-07-29 01:00:29.085410 |
Nuxt - Cross-Site Scripting via NoScript Component Slot Content
Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.
Published: 2026-06-20T15:21:56.449Z
Updated: 2026-06-24T17:53:34.670Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-56301 |
vulnerable | 2026-07-29 01:00:29.082401 |
Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
MEDIUM (5.5)
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.
Published: 2026-06-23T12:13:02.034Z
Updated: 2026-06-23T14:34:24.230Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.