By weakness (CWE)

CWE-83: related vulnerabilities

CVEs classified under CWE-83. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

4 published vulnerabilities

• CVE-2026-58263HIGH 7.2

  Jodit Editor versions before 4.12.28 contain a sanitization bypass vulnerability in its HTML cleaning feature. An attacker can craft malicious HTML using MathML and style tags to hide dangerous content from the sanitizer, allowing event handlers like onload to survive in the editor's output. When this compromised output is rendered by consuming applications, the event handlers execute automatically without any user interaction, enabling unauthorized script execution (Mutation XSS).

• CVE-2026-53841MEDIUM 6.1

  OpenClaw versions prior to 2026.5.12 contain a cross-site scripting (XSS) flaw in the exported session HTML feature. When users export session data, the resulting HTML file retains unsafe JavaScript and data URI links that have not been sanitized. If an operator opens this exported file in a browser and interacts with a malicious link, an attacker can execute arbitrary JavaScript in the operator's browser context. This is a social engineering attack requiring user action but can compromise an operator's session, credentials, or browser security.

• CVE-2026-45669MEDIUM 5.4

  Nuxt, a popular Vue.js web framework, has a vulnerability in its navigateTo() function when used with the external flag. If an application directs a user to an attacker-controlled URL using this function, the framework generates a server-side redirect page with insufficient sanitization. An attacker can inject malicious HTML and JavaScript into that redirect page, which then executes in the user's browser under the application's origin. This could allow session hijacking, credential theft, or malware distribution. The issue affects Nuxt versions 3.4.3 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5.

• CVE-2026-53722MEDIUM 5.4

  Nuxt, a popular Vue.js development framework, contains a cross-site scripting vulnerability in its <NuxtLink> component. The component fails to validate URL schemes in values bound to its `to` or `href` props, allowing attackers to inject malicious javascript: or vbscript: URLs. When a user clicks a link crafted this way, arbitrary JavaScript executes within the application's origin. The vulnerability affects versions before 3.21.7 and 4.4.7. Exploitation requires an attacker to control input that binds to the component—such as query parameters, CMS fields, or user profile URLs—and a user to click the malicious link.