CVE-2026-53722 Details

A reflected cross-site scripting vulnerability has been identified in the Nuxt framework, specifically within the NuxtLink component. This issue arises because the component did not properly validate the URL scheme of values assigned to its 'to' or 'href' props before rendering them in the 'href' attribute of the underlying anchor element. As a result, when applications bind user-controlled input—such as query parameters, CMS fields, or profile URLs—to NuxtLink, an attacker can inject 'javascript:' or 'vbscript:' URLs. These malicious scripts are executed in the context of the Nuxt application, leading to reflected DOM-based cross-site scripting. Additionally, a 'data:text/html,...' payload, while not executing the script, creates a phishing opportunity by anchoring to a legitimate application link. This vulnerability affects Nuxt versions 4.0.0 through 4.4.7 and prior to 3.21.7.

Users can upgrade to Nuxt versions 4.4.7 or 3.21.7, where this vulnerability has been patched. The fix involves sanitizing the 'href' value to remove control characters and whitespace, reject script-capable protocols, and ensure the link is safe before rendering.