CVE-2026-71318CWE-20

CVE-2026-71318

Medium · published August 6, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-06T02:17Z
References (3)
https://github.com/nuxt/nuxt/releases/tag/v3.21.10 · [email protected]https://github.com/nuxt/nuxt/releases/tag/v4.5.1 · [email protected]https://github.com/nuxt/nuxt/security/advisories/GHSA-48hr-524c-v5w3 · [email protected]
EPSS history
Timeline
  • 05 AUG 21:21Z
    Nuxt: Unauthorized Component Instantiation via Server Island Props
    cvelistv5