CVE-2026-56317 Details

A cross-site scripting vulnerability has been identified in Nuxt versions 4.0.0 prior to 4.4.7 and in the 3.x branch prior to 3.21.7. The issue arises in the NoScript component, which improperly handles slot content by writing it to innerHTML without escaping. This flaw allows attackers to inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters. The injected scripts execute in the document context when the NoScript tag is implicitly closed by script tags.

Users can upgrade to Nuxt versions 4.4.7 or 3.21.7, where this vulnerability has been patched. The fix involves escaping NoScript slot content and writing it to textContent instead of innerHTML. For applications that cannot be immediately upgraded, avoid placing untrusted input into NoScript slots or sanitize the data before use.