Vulnerability-Lookup

CVE-2026-71320 (GCVE-0-2026-71320)

Vulnerability from cvelistv5 – Published: 2026-08-05 21:29 – Updated: 2026-08-07 03:55

Title

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Summary

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/nuxt/nuxt/security/advisories/…	x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/5b60017f7f1d5…	x_refsource_MISC
https://github.com/nuxt/nuxt/commit/ee6c846338f4e…	x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v3.21.10	x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v4.5.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuxt	nuxt	Affected: >= 4.0.0, < 4.5.1 Affected: >= 3.4.0, < 3.21.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71320",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T03:55:36.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuxt",
          "vendor": "nuxt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.4.0, \u003c 3.21.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T21:29:51.370Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq"
        },
        {
          "name": "https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418"
        },
        {
          "name": "https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859"
        },
        {
          "name": "https://github.com/nuxt/nuxt/releases/tag/v3.21.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/releases/tag/v3.21.10"
        },
        {
          "name": "https://github.com/nuxt/nuxt/releases/tag/v4.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/releases/tag/v4.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9473-5f9j-94wq",
        "discovery": "UNKNOWN"
      },
      "title": "Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71320",
    "datePublished": "2026-08-05T21:29:51.370Z",
    "dateReserved": "2026-08-05T18:14:42.065Z",
    "dateUpdated": "2026-08-07T03:55:36.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71320",
      "date": "2026-08-08",
      "epss": "0.00438",
      "percentile": "0.36073"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-71320\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-05T22:17:08.367\",\"lastModified\":\"2026-08-07T05:17:03.773\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"nuxt\",\"product\":\"nuxt\",\"versions\":[{\"version\":\"\u003e= 4.0.0, \u003c 4.5.1\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.4.0, \u003c 3.21.10\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-06T00:00:00+00:00\",\"id\":\"CVE-2026-71320\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"},{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"references\":[{\"url\":\"https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nuxt/nuxt/releases/tag/v3.21.10\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nuxt/nuxt/releases/tag/v4.5.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-71320\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-06T13:32:06.655104Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-06T13:32:11.491Z\"}}], \"cna\": {\"title\": \"Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props\", \"source\": {\"advisory\": \"GHSA-9473-5f9j-94wq\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"nuxt\", \"product\": \"nuxt\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 4.5.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.4.0, \u003c 3.21.10\"}]}], \"references\": [{\"url\": \"https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq\", \"name\": \"https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418\", \"name\": \"https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859\", \"name\": \"https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nuxt/nuxt/releases/tag/v3.21.10\", \"name\": \"https://github.com/nuxt/nuxt/releases/tag/v3.21.10\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nuxt/nuxt/releases/tag/v4.5.1\", \"name\": \"https://github.com/nuxt/nuxt/releases/tag/v4.5.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-74\", \"description\": \"CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-05T21:29:51.370Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-71320\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-07T03:55:36.649Z\", \"dateReserved\": \"2026-08-05T18:14:42.065Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-05T21:29:51.370Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-9473-5F9J-94WQ

Vulnerability from github – Published: 2026-08-05 21:29 – Updated: 2026-08-05 21:29

Summary

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Details

Impact

Nuxt server islands accept props via the /__nuxt_island/ endpoint. When vue.runtimeCompiler: true is enabled (off by default) and the application has a server island component that forwards props into Vue's dynamic component resolution (<component :is>, resolveDynamicComponent, or h()), an attacker can inject a template key into the island props to achieve server-side remote code execution in the Nitro process.

{ "as": { "template": "<attacker-controlled>" } }

Vue's runtime template compiler compiles and executes the attacker-controlled template in the server process. The same primitive also works on the client side when the runtime compiler is active there, though the server-side path is the primary concern.

Some component libraries expose a polymorphic as / asChild prop that forwards its value into <component :is>; @nuxt/ui (via reka-ui) is a widely used example. An application is affected if such a component receives the attacker-controlled value, provided vue.runtimeCompiler is also enabled. Note this does not require the island author to explicitly forward a prop: island props that the island component does not declare fall through as attributes onto its single root element (standard Vue attribute inheritance), so an island whose root is a polymorphic component receives the attacker's as value implicitly. These libraries are not themselves vulnerable; they are noted only because they commonly provide the dynamic-component sink.

Common configurations that satisfy the preconditions

The flaw is in Nuxt core. The library below is not itself vulnerable; it is noted because it commonly provides the dynamic-component sink an application might inadvertently expose.

@nuxt/ui (via its underlying reka-ui primitives) exposes a polymorphic as / asChild prop that is forwarded into Vue's dynamic-component resolution. Installing @nuxt/ui does not by itself register any component as a server island. Exploitation requires the application to define an island component (a .server.vue file) whose rendered output puts the attacker-controlled value on such a component's as / asChild prop; with vue.runtimeCompiler: true, the attacker-controlled template is then compiled and executed. Because undeclared island props fall through as attributes to the single root, this can happen without any explicit binding: an island whose root is a reka-ui / @nuxt/ui component is enough. An example vulnerable island (the as value falls through to UButton, no explicit forwarding needed):

```vue

Save ```

The island URL hash (/__nuxt_island/<Name>_<hash>.json) is a deterministic (unsalted) content hash, not an authentication token. It provides integrity relative to the URL but is not a security boundary: an attacker who knows the component name and desired props can compute a valid hash.

Mitigating factors

vue.runtimeCompiler is off by default in Nuxt. The vast majority of Nuxt applications are not affected.
Exploitation requires a second precondition: the application must have a server island component that puts an attacker-controlled value onto a dynamic-component path (<component :is>, resolveDynamicComponent, h(), or a polymorphic as / asChild prop). This can occur explicitly or via attribute fallthrough when the island's root is such a component.
SSG / static deployments are largely unreachable via this vector (no server process to exploit).
Island component names are constrained to the build-time component registry; an attacker cannot resolve arbitrary components.

Affected versions

Nuxt >=3.4.0 <3.21.10 and >=4.0.0 <4.5.1, and only when vue.runtimeCompiler: true and component islands are active. Earlier versions did not allow the Vue compiler to be enabled in the server bundle (the compiler dependencies have been mock-aliased on the server since v3.0.0-rc.1), so the runtime-compilation path is not reachable. Nuxt 2 is not affected (no server islands).

Patches

When vue.runtimeCompiler is enabled, island requests whose decoded props contain a template key at any depth are rejected with an HTTP 400 and a diagnostic suggesting the author rename the prop or disable the runtime compiler. The guard is gated on the runtime compiler being enabled, so the default configuration (compiler off) is unaffected and legitimate props that merely contain a template field (for example CMS content) continue to render. A render key is not rejected: island props arrive as JSON, so a render value can only be an inert string, which Vue ignores.

Fixed in nuxt@4.5.1 and backported to nuxt@3.21.10.

Workarounds

Upgrade to nuxt@4.5.1 or nuxt@3.21.10. If you cannot immediately upgrade, you can mitigate by:

Ensure vue.runtimeCompiler is set to false (the default).
Do not forward island props into <component :is>, resolveDynamicComponent, or h() without sanitization.
As a defense-in-depth measure, deploy a WAF rule on /__nuxt_island/ that URL-decodes and JSON-parses the props value and blocks any object property named template or render in the decoded island props, inspecting both query and body for all methods. Note: this only covers direct and browser-originated island requests; initial-SSR internal island renders do not transit the edge and a WAF alone does not close the vector.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.4.0"
            },
            {
              "fixed": "3.21.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71320"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T21:29:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Impact\n\nNuxt server islands accept props via the `/__nuxt_island/` endpoint. When `vue.runtimeCompiler: true` is enabled (off by default) and the application has a server island component that forwards props into Vue\u0027s dynamic component resolution (`\u003ccomponent :is\u003e`, `resolveDynamicComponent`, or `h()`), an attacker can inject a `template` key into the island props to achieve server-side remote code execution in the Nitro process.\n\n```json\n{ \"as\": { \"template\": \"\u003cattacker-controlled\u003e\" } }\n```\n\nVue\u0027s runtime template compiler compiles and executes the attacker-controlled `template` in the server process. The same primitive also works on the client side when the runtime compiler is active there, though the server-side path is the primary concern.\n\nSome component libraries expose a polymorphic `as` / `asChild` prop that forwards its value into `\u003ccomponent :is\u003e`; `@nuxt/ui` (via `reka-ui`) is a widely used example. An application is affected if such a component receives the attacker-controlled value, provided `vue.runtimeCompiler` is also enabled. Note this does not require the island author to explicitly forward a prop: island props that the island component does not declare fall through as attributes onto its single root element (standard Vue attribute inheritance), so an island whose root is a polymorphic component receives the attacker\u0027s `as` value implicitly. These libraries are not themselves vulnerable; they are noted only because they commonly provide the dynamic-component sink.\n\n## Common configurations that satisfy the preconditions\n\nThe flaw is in Nuxt core. The library below is not itself vulnerable; it is noted because it commonly provides the dynamic-component sink an application might inadvertently expose.\n\n- **`@nuxt/ui`** (via its underlying **`reka-ui`** primitives) exposes a polymorphic `as` / `asChild` prop that is forwarded into Vue\u0027s dynamic-component resolution. Installing `@nuxt/ui` does not by itself register any component as a server island. Exploitation requires the application to define an island component (a `.server.vue` file) whose rendered output puts the attacker-controlled value on such a component\u0027s `as` / `asChild` prop; with `vue.runtimeCompiler: true`, the attacker-controlled `template` is then compiled and executed. Because undeclared island props fall through as attributes to the single root, this can happen without any explicit binding: an island whose root is a `reka-ui` / `@nuxt/ui` component is enough. An example vulnerable island (the `as` value falls through to `UButton`, no explicit forwarding needed):\n\n  ```vue\n  \u003c!-- components/MyWidget.server.vue --\u003e\n  \u003ctemplate\u003e\n    \u003cUButton\u003eSave\u003c/UButton\u003e\n  \u003c/template\u003e\n  ```\n\nThe island URL hash (`/__nuxt_island/\u003cName\u003e_\u003chash\u003e.json`) is a deterministic (unsalted) content hash, not an authentication token. It provides integrity relative to the URL but is not a security boundary: an attacker who knows the component name and desired props can compute a valid hash.\n\n## Mitigating factors\n\n- `vue.runtimeCompiler` is **off by default** in Nuxt. The vast majority of Nuxt applications are not affected.\n- Exploitation requires a **second precondition**: the application must have a server island component that puts an attacker-controlled value onto a dynamic-component path (`\u003ccomponent :is\u003e`, `resolveDynamicComponent`, `h()`, or a polymorphic `as` / `asChild` prop). This can occur explicitly or via attribute fallthrough when the island\u0027s root is such a component.\n- SSG / static deployments are largely unreachable via this vector (no server process to exploit).\n- Island component names are constrained to the build-time component registry; an attacker cannot resolve arbitrary components.\n\n## Affected versions\n\nNuxt `\u003e=3.4.0 \u003c3.21.10` and `\u003e=4.0.0 \u003c4.5.1`, and only when `vue.runtimeCompiler: true` and component islands are active. Earlier versions did not allow the Vue compiler to be enabled in the server bundle (the compiler dependencies have been mock-aliased on the server since v3.0.0-rc.1), so the runtime-compilation path is not reachable. Nuxt 2 is not affected (no server islands).\n\n## Patches\n\nWhen `vue.runtimeCompiler` is enabled, island requests whose decoded props contain a `template` key at any depth are rejected with an HTTP 400 and a diagnostic suggesting the author rename the prop or disable the runtime compiler. The guard is gated on the runtime compiler being enabled, so the default configuration (compiler off) is unaffected and legitimate props that merely contain a `template` field (for example CMS content) continue to render. A `render` key is not rejected: island props arrive as JSON, so a `render` value can only be an inert string, which Vue ignores.\n\nFixed in `nuxt@4.5.1` and backported to `nuxt@3.21.10`.\n\n## Workarounds\n\nUpgrade to `nuxt@4.5.1` or `nuxt@3.21.10`. If you cannot immediately upgrade, you can mitigate by:\n\n1. Ensure `vue.runtimeCompiler` is set to `false` (the default).\n2. Do not forward island props into `\u003ccomponent :is\u003e`, `resolveDynamicComponent`, or `h()` without sanitization.\n3. As a defense-in-depth measure, deploy a WAF rule on `/__nuxt_island/` that URL-decodes and JSON-parses the `props` value and blocks any object property named `template` or `render` in the decoded island props, inspecting both query and body for all methods. Note: this only covers direct and browser-originated island requests; initial-SSR internal island renders do not transit the edge and a WAF alone does not close the vector.",
  "id": "GHSA-9473-5f9j-94wq",
  "modified": "2026-08-05T21:29:55Z",
  "published": "2026-08-05T21:29:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nuxt/nuxt"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/releases/tag/v3.21.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/releases/tag/v4.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted