https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 05:54:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326952 EUVD-2026-326952 https://cve.radiocsirt.org/vuln/euvd-2026-326952 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46342 <p>Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (&lt;Name&gt;_&lt;hashId&gt;.json) was actually issued for those inputs by &lt;NuxtIsland&gt;. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been patched in versions 3.21.6 and 4.4.6.</p> <p>Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (&lt;Name&gt;_&lt;hashId&gt;.json) was actually issued for those inputs by &lt;NuxtIsland&gt;. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been patched in versions 3.21.6 and 4.4.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46342 https://cve.radiocsirt.org/vuln/ghsa-g8wj-3cr3-6w7v <p><strong>Affected:</strong> npm: nuxt, npm: @nuxt/nitro-server</p> <p>### Summary</p> <p>The `/__nuxt_island/*` endpoint accepts attacker-controlled `props` query/body parameters and renders any island component without verifying that the URL-resident hash (`&lt;Name&gt;_&lt;hashId&gt;.json`) was actually issued for those inputs by `&lt;NuxtIsland&gt;`. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query.</p> <p>Island components are documented as rendering independently of route context - page middleware does not apply to them, and they are intentionally cacheable as a function of their props. This advisory does **not** treat that contract as a vulnerability. It treats the absence of a binding between the URL the cache keys on and the response served at that URL as one.</p> <p>### Impact</p> <p>In applications where a CDN or reverse-proxy in front of the app caches `/__nuxt_island/*` keyed by path only (ignoring query) - a documented misconfiguration class, see GHSA-jvhm-gjrh-3h93 - an attacker can prime the cache for a path with their own choice of props, and subsequent users requesting the same path receive the attacker&#39;s rendered HTML rather than the response intended for them. The cache entry persists until normal expiry.</p> <p>Where the affected island has any prop flowing into an unsafe HTML sink in application code (`v-html`, `innerHTML`, a third-party renderer treating a prop as HTML), this becomes stored XSS in the embedding page&#39;s origin until the cache entry expires. `Ht…</p> <p><strong>Affected:</strong> npm: nuxt, npm: @nuxt/nitro-server</p> <p>### Summary</p> <p>The `/__nuxt_island/*` endpoint accepts attacker-controlled `props` query/body parameters and renders any island component without verifying that the URL-resident hash (`&lt;Name&gt;_&lt;hashId&gt;.json`) was actually issued for those inputs by `&lt;NuxtIsland&gt;`. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query.</p> <p>Island components are documented as rendering independently of route context - page middleware does not apply to them, and they are intentionally cacheable as a function of their props. This advisory does **not** treat that contract as a vulnerability. It treats the absence of a binding between the URL the cache keys on and the response served at that URL as one.</p> <p>### Impact</p> <p>In applications where a CDN or reverse-proxy in front of the app caches `/__nuxt_island/*` keyed by path only (ignoring query) - a documented misconfiguration class, see GHSA-jvhm-gjrh-3h93 - an attacker can prime the cache for a path with their own choice of props, and subsequent users requesting the same path receive the attacker&#39;s rendered HTML rather than the response intended for them. The cache entry persists until normal expiry.</p> <p>Where the affected island has any prop flowing into an unsafe HTML sink in application code (`v-html`, `innerHTML`, a third-party renderer treating a prop as HTML), this becomes stored XSS in the embedding page&#39;s origin until the cache entry expires. `Ht…</p> https://cve.radiocsirt.org/vuln/ghsa-g8wj-3cr3-6w7v