CVE-2026-53722: Nuxt <NuxtLink> XSS Vulnerability – Versions 3.21.7 & 4.4.7 Required

Technical summary

The <NuxtLink> component does not perform scheme validation on URL values before rendering them into the href attribute of underlying <a> elements. When attacker-controlled input is bound to the `to` or `:href` props, a javascript: or vbscript: scheme URL is reflected verbatim into the DOM. Additionally, the href and route.href values exposed to custom slot consumers can be re-bound by applications to their own anchors, extending the attack surface. While data:text/html,... payloads do not execute in the application origin, they can be leveraged for same-tab phishing attacks. This is a reflected DOM-based XSS vulnerability affecting the rendering layer, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-83 (Improper Neutralization of Script-Related HTML Tags).

Business impact

Organizations running Nuxt-based applications that accept and reflect user-supplied URLs risk credential theft, session hijacking, and malware distribution through reflected XSS. Customer-facing applications—particularly those with user profiles, community forums, or dynamic content sourced from CMS platforms—face reputational damage if attackers inject phishing payloads or keyloggers. The vulnerability requires user interaction (a click), reducing the attack surface compared to stored XSS but remaining practical in scenarios where attackers can embed links in emails, chat, or social platforms. Affected versions deployed in production should be prioritized for upgrade to prevent this class of attack.

Affected systems

Nuxt framework versions prior to 3.21.7 (v3.x line) and prior to 4.4.7 (v4.x line) are vulnerable. Any Nuxt application that binds untrusted input—query parameters, API responses, user profile data, or CMS content—to <NuxtLink :to> or :href props is at risk. Applications using custom slots that re-bind the exposed href or route.href props to their own anchor elements inherit the same risk. Node.js applications and server-side rendering (SSR) contexts are in scope where client-side rendering ultimately exposes the vulnerability.

Exploitability

Exploitation is straightforward and requires no special privileges or authentication. An attacker crafts a malicious URL with a javascript: scheme and supplies it through any input vector that reaches a <NuxtLink> binding—a URL parameter, form submission, or API endpoint. The attack is reflected and requires a user to click the link, making social engineering necessary but not uncommon in practice. The CVSS score of 5.4 (MEDIUM) reflects network accessibility, low attack complexity, no privilege requirement, and required user interaction, balanced against limited impact (low confidentiality and integrity, no availability impact).

Remediation

Upgrade Nuxt to version 3.21.7 or later (v3.x) or version 4.4.7 or later (v4.x). Verify compatibility with your application before deploying, particularly if custom build configurations or pinned dependencies exist. As a temporary mitigation, sanitize or validate URL schemes at the application level before binding to <NuxtLink> components—allow only http://, https://, and relative paths, and reject javascript:, vbscript:, and data: schemes. Implement Content Security Policy (CSP) with a strict script-src directive to limit reflected script execution even if a payload reaches the DOM.

Patch guidance

Review your package.json or lock file to identify your current Nuxt version. If running 3.x, update to 3.21.7 or later; if running 4.x, update to 4.4.7 or later. Test the upgrade in a staging environment, paying particular attention to any custom <NuxtLink> overrides or slot implementations. Verify that URL binding behavior matches your expectations after patching. Monitor the official Nuxt security advisory for any follow-up guidance or related issues.

Detection guidance

Monitor for the presence of javascript: or vbscript: schemes in href attributes rendered within your Nuxt application. Review server logs and traffic for suspicious URL parameters passed to routes that feed <NuxtLink> components. In a static analysis context, audit your codebase for <NuxtLink> components binding untrusted input without prior sanitization. Implement CSP violation reporting to catch injected payloads that bypass client-side filtering. After patching, verify that malicious URL schemes no longer execute by testing with harmless javascript: payloads in your staging environment.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prioritization in web-facing Nuxt applications because it is practical to exploit, requires no authentication, and directly impacts user security. Applications accepting user-supplied URLs (profiles, community content, CMS integrations) should patch immediately. Low-risk environments (internal tools, closed user groups) can follow a standard patching cadence. The lack of current KEV designation does not diminish the risk—this reflects early disclosure timing, not severity.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) requiring no privileges (PR:N) but user interaction (UI:R). The impact is limited: low confidentiality (credentials, session tokens can be stolen) and low integrity (malicious script execution), with no availability impact. The unscoped impact (S:U) means the attack does not cross security boundaries. In context, the practical exploitability and reputational risk to customer-facing applications may warrant treating this as higher priority than the numerical score alone suggests.

Frequently asked questions