https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 07:39:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349207 EUVD-2026-349207 https://cve.radiocsirt.org/vuln/euvd-2026-349207 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71320 <p>Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.</p> <p>Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71320 https://cve.radiocsirt.org/vuln/ghsa-9473-5f9j-94wq <p><strong>Affected:</strong> npm: nuxt</p> <p>## Impact</p> <p>Nuxt server islands accept props via the `/__nuxt_island/` endpoint. When `vue.runtimeCompiler: true` is enabled (off by default) and the application has a server island component that forwards props into Vue&#39;s dynamic component resolution (`&lt;component :is&gt;`, `resolveDynamicComponent`, or `h()`), an attacker can inject a `template` key into the island props to achieve server-side remote code execution in the Nitro process.</p> <p>```json { &#34;as&#34;: { &#34;template&#34;: &#34;&lt;attacker-controlled&gt;&#34; } } ```</p> <p>Vue&#39;s runtime template compiler compiles and executes the attacker-controlled `template` in the server process. The same primitive also works on the client side when the runtime compiler is active there, though the server-side path is the primary concern.</p> <p>Some component libraries expose a polymorphic `as` / `asChild` prop that forwards its value into `&lt;component :is&gt;`; `@nuxt/ui` (via `reka-ui`) is a widely used example. An application is affected if such a component receives the attacker-controlled value, provided `vue.runtimeCompiler` is also enabled. Note this does not require the island author to explicitly forward a prop: island props that the island component does not declare fall through as attributes onto its single root element (standard Vue attribute inheritance), so an island whose root is a polymorphic component receives the attacker&#39;s `as` value implicitly. These libraries are not themselves vulnerable; they are noted only because they commonly provide the dynamic-comp…</p> <p><strong>Affected:</strong> npm: nuxt</p> <p>## Impact</p> <p>Nuxt server islands accept props via the `/__nuxt_island/` endpoint. When `vue.runtimeCompiler: true` is enabled (off by default) and the application has a server island component that forwards props into Vue&#39;s dynamic component resolution (`&lt;component :is&gt;`, `resolveDynamicComponent`, or `h()`), an attacker can inject a `template` key into the island props to achieve server-side remote code execution in the Nitro process.</p> <p>```json { &#34;as&#34;: { &#34;template&#34;: &#34;&lt;attacker-controlled&gt;&#34; } } ```</p> <p>Vue&#39;s runtime template compiler compiles and executes the attacker-controlled `template` in the server process. The same primitive also works on the client side when the runtime compiler is active there, though the server-side path is the primary concern.</p> <p>Some component libraries expose a polymorphic `as` / `asChild` prop that forwards its value into `&lt;component :is&gt;`; `@nuxt/ui` (via `reka-ui`) is a widely used example. An application is affected if such a component receives the attacker-controlled value, provided `vue.runtimeCompiler` is also enabled. Note this does not require the island author to explicitly forward a prop: island props that the island component does not declare fall through as attributes onto its single root element (standard Vue attribute inheritance), so an island whose root is a polymorphic component receives the attacker&#39;s `as` value implicitly. These libraries are not themselves vulnerable; they are noted only because they commonly provide the dynamic-comp…</p> https://cve.radiocsirt.org/vuln/ghsa-9473-5f9j-94wq