CVE-2026-45669 Details
Description
Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigateTo() with external: true generates a server-side HTML redirect body containing a <meta http-equiv="refresh"> tag. The destination URL is only sanitized by replacing " with %22, leaving <, >, &, and ' unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content="…" attribute and inject arbitrary HTML/JavaScript that executes under the application's origin. This issue has been patched in versions 3.21.6 and 4.4.6.
A reflected cross-site scripting vulnerability has been identified in Nuxt, an open-source web development framework for Vue.js. This issue affects versions 3.4.3 prior to 3.21.6, as well as 4.0.0-alpha.1 prior to 4.4.6. The vulnerability arises in the `navigateTo()` function when the `external` option is set to true. In this scenario, the server-side HTML redirect body includes a `<meta http-equiv="refresh">` tag. However, the destination URL is only partially sanitized, leaving certain characters unencoded. An attacker who can manipulate the URL passed to `navigateTo(url, { external: true })` can inject arbitrary HTML or JavaScript that executes under the application's origin. This vulnerability has been patched in Nuxt versions 3.21.6 and 4.4.6.
Users can upgrade to Nuxt versions 3.21.6 or 4.4.6, where this vulnerability has been fixed. If an immediate upgrade is not possible, validate user-controlled URLs before passing them to `navigateTo(url, { external: true })`. At a minimum, normalize the URL using the URL constructor and reject any inputs containing `<` or `>`.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuxt/nuxt/security/advisories/GHSA-fx6j-w5w5-h468 | CISA-ADP | ExploitPatchVendor Advisory |
| https://github.com/nuxt/nuxt/pull/35052 | [email protected] | Issue Tracking |
| https://github.com/nuxt/nuxt/security/advisories/GHSA-fx6j-w5w5-h468 | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nuxt nuxt | >= 3.4.3, < 3.21.6 >= 4.0.0, < 4.4.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |