https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 05:23:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-348962 EUVD-2026-348962 https://cve.radiocsirt.org/vuln/euvd-2026-348962 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71318 <p>Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through &lt;component :is&gt;, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.</p> <p>Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through &lt;component :is&gt;, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71318 https://cve.radiocsirt.org/vuln/ghsa-48hr-524c-v5w3 <p><strong>Affected:</strong> npm: nuxt</p> <p>## Impact</p> <p>Nuxt server islands accept props via the `/__nuxt_island/` endpoint. When an application has a server island component that forwards props directly into Vue&#39;s dynamic component resolution (`&lt;component :is&gt;`, `resolveDynamicComponent`, or `h()`), an attacker can pass a plain string value (rather than a component definition) to instantiate any globally-registered Vue component or any native HTML element.</p> <p>For example: ```json { &#34;as&#34;: &#34;SomeGlobalComponent&#34; } ```</p> <p>...resolves and renders `SomeGlobalComponent` if it is globally registered, even though the attacker should only be able to drive props for the island&#39;s declared component. Similarly, `{ &#34;as&#34;: &#34;iframe&#34; }` renders an `&lt;iframe&gt;` element.</p> <p>Unlike the primary RCE vector (GHSA-9473-5f9j-94wq), this does **not** require `vue.runtimeCompiler` to be enabled. A plain string prop is sufficient to trigger component resolution. The `template`/`render` key guard that addresses the RCE vector does not block plain string values.</p> <p>Some component libraries expose a polymorphic `as` / `asChild` prop that forwards its value into `&lt;component :is&gt;`; `@nuxt/ui` (via `reka-ui`) is a widely used example. An application is affected if such a component receives the attacker-controlled value inside a server island. Note this does not require explicit prop forwarding: island props the island component does not declare fall through as attributes onto its single root element, so an island whose root is a `reka-ui` / `@nuxt/ui` component…</p> <p><strong>Affected:</strong> npm: nuxt</p> <p>## Impact</p> <p>Nuxt server islands accept props via the `/__nuxt_island/` endpoint. When an application has a server island component that forwards props directly into Vue&#39;s dynamic component resolution (`&lt;component :is&gt;`, `resolveDynamicComponent`, or `h()`), an attacker can pass a plain string value (rather than a component definition) to instantiate any globally-registered Vue component or any native HTML element.</p> <p>For example: ```json { &#34;as&#34;: &#34;SomeGlobalComponent&#34; } ```</p> <p>...resolves and renders `SomeGlobalComponent` if it is globally registered, even though the attacker should only be able to drive props for the island&#39;s declared component. Similarly, `{ &#34;as&#34;: &#34;iframe&#34; }` renders an `&lt;iframe&gt;` element.</p> <p>Unlike the primary RCE vector (GHSA-9473-5f9j-94wq), this does **not** require `vue.runtimeCompiler` to be enabled. A plain string prop is sufficient to trigger component resolution. The `template`/`render` key guard that addresses the RCE vector does not block plain string values.</p> <p>Some component libraries expose a polymorphic `as` / `asChild` prop that forwards its value into `&lt;component :is&gt;`; `@nuxt/ui` (via `reka-ui`) is a widely used example. An application is affected if such a component receives the attacker-controlled value inside a server island. Note this does not require explicit prop forwarding: island props the island component does not declare fall through as attributes onto its single root element, so an island whose root is a `reka-ui` / `@nuxt/ui` component…</p> https://cve.radiocsirt.org/vuln/ghsa-48hr-524c-v5w3