https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:45:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326865 EUVD-2026-326865 https://cve.radiocsirt.org/vuln/euvd-2026-326865 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45669 <p>Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigateTo() with external: true generates a server-side HTML redirect body containing a &lt;meta http-equiv=&#34;refresh&#34;&gt; tag. The destination URL is only sanitized by replacing &#34; with %22, leaving &lt;, &gt;, &amp;, and &#39; unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content=&#34;…&#34; attribute and inject arbitrary HTML/JavaScript that executes under the application&#39;s origin. This issue has been patched in versions 3.21.6 and 4.4.6.</p> <p>Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigateTo() with external: true generates a server-side HTML redirect body containing a &lt;meta http-equiv=&#34;refresh&#34;&gt; tag. The destination URL is only sanitized by replacing &#34; with %22, leaving &lt;, &gt;, &amp;, and &#39; unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content=&#34;…&#34; attribute and inject arbitrary HTML/JavaScript that executes under the application&#39;s origin. This issue has been patched in versions 3.21.6 and 4.4.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45669 https://cve.radiocsirt.org/vuln/ghsa-fx6j-w5w5-h468 <p><strong>Affected:</strong> npm: nuxt</p> <p>### Summary `navigateTo()` with `external: true` generates a server-side HTML redirect body containing a `&lt;meta http-equiv=&#34;refresh&#34;&gt;` tag. The destination URL is only sanitized by replacing `&#34;` with `%22`, leaving `&lt;`, `&gt;`, `&amp;`, and `&#39;` unencoded. An attacker who can influence the URL passed to `navigateTo(url, { external: true })` can break out of the `content=&#34;…&#34;` attribute and inject arbitrary HTML/JavaScript that executes under the application&#39;s origin.</p> <p>This is a different root cause from CVE-2024-34343 (GHSA-vf6r-87q4-2vjf), which addressed `javascript:` protocol bypass. The issue here is triggered by any valid URL containing `&gt;`.</p> <p>### Impact Applications that pass user-controlled input to `navigateTo(url, { external: true })` — typically via a `?next=` / `?redirect=` query parameter used for post-login or &#34;return to&#34; flows — are vulnerable to reflected cross-site scripting. The injected script runs in the context of the application&#39;s origin during the server-rendered redirect response, before the meta-refresh fires.</p> <p>### Details In `packages/nuxt/src/app/composables/router.ts`, the SSR redirect path builds an HTML response body with only `&#34;` percent-encoded in the destination URL:</p> <p>```ts const encodedLoc = location.replace(/&#34;/g, &#39;%22&#39;) nuxtApp.ssrContext![&#39;~renderResponse&#39;] = { status: sanitizeStatusCode(options?.redirectCode || 302, 302), body: `&lt;!DOCTYPE html&gt;&lt;html&gt;&lt;head&gt;&lt;meta http-equiv=&#34;refresh&#34; content=&#34;0; url=${encodedLoc}&#34;&gt;&lt;/head&gt;&lt;/html&gt;`, headers: { location:…</p> <p><strong>Affected:</strong> npm: nuxt</p> <p>### Summary `navigateTo()` with `external: true` generates a server-side HTML redirect body containing a `&lt;meta http-equiv=&#34;refresh&#34;&gt;` tag. The destination URL is only sanitized by replacing `&#34;` with `%22`, leaving `&lt;`, `&gt;`, `&amp;`, and `&#39;` unencoded. An attacker who can influence the URL passed to `navigateTo(url, { external: true })` can break out of the `content=&#34;…&#34;` attribute and inject arbitrary HTML/JavaScript that executes under the application&#39;s origin.</p> <p>This is a different root cause from CVE-2024-34343 (GHSA-vf6r-87q4-2vjf), which addressed `javascript:` protocol bypass. The issue here is triggered by any valid URL containing `&gt;`.</p> <p>### Impact Applications that pass user-controlled input to `navigateTo(url, { external: true })` — typically via a `?next=` / `?redirect=` query parameter used for post-login or &#34;return to&#34; flows — are vulnerable to reflected cross-site scripting. The injected script runs in the context of the application&#39;s origin during the server-rendered redirect response, before the meta-refresh fires.</p> <p>### Details In `packages/nuxt/src/app/composables/router.ts`, the SSR redirect path builds an HTML response body with only `&#34;` percent-encoded in the destination URL:</p> <p>```ts const encodedLoc = location.replace(/&#34;/g, &#39;%22&#39;) nuxtApp.ssrContext![&#39;~renderResponse&#39;] = { status: sanitizeStatusCode(options?.redirectCode || 302, 302), body: `&lt;!DOCTYPE html&gt;&lt;html&gt;&lt;head&gt;&lt;meta http-equiv=&#34;refresh&#34; content=&#34;0; url=${encodedLoc}&#34;&gt;&lt;/head&gt;&lt;/html&gt;`, headers: { location:…</p> https://cve.radiocsirt.org/vuln/ghsa-fx6j-w5w5-h468