CVE-2026-56698: Nuxt navigateTo XSS Vulnerability – Patch Guidance

Technical summary

The vulnerability is a Cross-Site Scripting (XSS) flaw (CWE-79) stemming from inadequate input validation in the navigateTo function's open option. The open parameter accepts and processes javascript: protocol URLs without sanitization, allowing attackers to inject and execute arbitrary ECMAScript in the application's context. This occurs when untrusted, user-controlled data is passed to the open parameter. The CVSS 3.1 vector (6.1/MEDIUM) reflects a network attack surface with no special privileges required, requiring user interaction, and potentially affecting confidentiality and integrity of data accessible within the application's origin. The impact is scoped to the current application context rather than other security domains.

Business impact

Applications using vulnerable Nuxt versions with user-controlled navigation parameters face credential theft, session hijacking, and malware distribution risks. If an attacker injects a malicious javascript: URL, they can steal authentication tokens, exfiltrate sensitive user data, modify page content, or redirect users to phishing sites—all without triggering obvious browser security warnings. Organizations deploying Nuxt-based applications must prioritize patching to prevent unauthorized script execution that could compromise customer data and erode user trust.

Affected systems

Affected versions include Nuxt 4.0.0 through 4.4.6 (4.4.7 and later are patched) and Nuxt 3.x through 3.21.6 (3.21.7 and later are patched). Any application using navigateTo with the open option where the destination is influenced by user input or external data sources is at risk. This includes single-page applications that programmatically navigate users based on query parameters, form input, API responses, or redirects.

Exploitability

Exploitation is straightforward for an attacker positioned to influence user input or control navigation targets. The attack surface is broad: query strings, form data, API responses, or any channel through which user input reaches the navigateTo open parameter. However, exploitation requires active user interaction—a user must trigger the navigation action. There is no evidence of widespread exploitation or public proof-of-concept weaponization at this time, though the simplicity of crafting a javascript: URL means an attacker with minimal sophistication can construct a payload. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade to Nuxt 4.4.7 or later for version 4 users, or Nuxt 3.21.7 or later for version 3 users. Verify against the official Nuxt security advisory for exact patched versions and any interim guidance. Until patching is complete, implement server-side or client-side input validation to reject javascript: and data: protocol URLs in navigation targets, and apply Content Security Policy (CSP) directives to restrict script execution sources. Additionally, avoid passing unvalidated user input directly to navigateTo; sanitize and validate all navigation destinations against an allowlist of safe URLs.

Patch guidance

Patch immediately for production environments. The fix is available in Nuxt 4.4.7+ and 3.21.7+. Review your package.json and dependency lock files to confirm current versions, then upgrade using npm/yarn/pnpm. Test thoroughly in a staging environment to ensure third-party integrations and custom navigation logic remain functional. For applications unable to patch immediately, apply compensating controls such as URL allowlisting or CSP headers to mitigate the risk of malicious navigation payloads.

Detection guidance

Monitor logs and network traffic for unexpected javascript: or data: protocol URLs in navigateTo parameters or page redirects. Implement browser-based monitoring (e.g., via CSP violation reports or error logging) to detect script execution attempts outside expected sources. Code review existing navigateTo calls to identify instances where user input or external data influences the open parameter without validation. Security scanning tools that parse JavaScript frameworks may flag unsafe navigateTo usage; prioritize remediation of those findings.

Why prioritize this

While rated MEDIUM severity, this vulnerability merits rapid patching because it enables arbitrary script execution in the application's origin, affecting confidentiality and integrity of user sessions and data. The low barrier to exploitation and broad attack surface—any user-controlled input path to navigateTo—make this a credible risk for applications with authentication or sensitive content. Organizations should prioritize this within 30 days of patch availability.

Risk score, explained

The CVSS 6.1 score balances several factors: network-accessible attack vector, low attack complexity, no authentication requirement, and user interaction requirement. The score reflects limited impact scope (application origin only) and partial compromise of confidentiality and integrity rather than availability. Organizations with heightened user trust requirements, regulated data, or high user volumes should consider this a higher priority than the base MEDIUM rating suggests.

Frequently asked questions