CVE-2026-34405: Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes
Product: Nuxt OG Image Version: 6.1.2 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation Description: Incorrect parsing of GET parameters leads to the possibility of HTML injection and JavaScript code injection. Impact: Client-Side JavaScript Execution Exploitation condition: An external user Mitigation: Correct the logic of parsing GET parameters and their subsequent implementation into the generated page. Researcher: Dmitry Prokhorov (Positive Technologies)
Research During the analysis of the nuxt-og-image package, which is shipped with the nuxt-seo package, a zero‑day vulnerability was discovered. This research revealed that the image‑generation component by the URI: /og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. The vulnerability was reproduced using the standard configuration and the default templates.
Listing 1. The content of the configuration file nuxt.config.ts export default defineNuxtConfig({ modules: ['nuxt-og-image'], devServer: { host: 'web-test.local', port: 3000 }, site: { url: 'http://web-test.local:3000', }, ogImage: { fonts: [ 'Inter:400', 'Inter:700' ], } })
Vulnerability reproduction To demonstrate the proof‑of‑concept, follow the URI: /og/d/og.html?width=1000&height=1000&onmouseover=alert(document.cookie)&autofocus The injected parameters onmouseover=alert(document.cookie) and autofocus are treated as attributes and are inserted directly into the generated HTML page.
Listing 2. HTTP-request example GET /og/d/og.html?width=1000&height=1000&onmouseover=alert(document.cookie) HTTP/1.1 Host: web-test.local:3000
Figure 1. The injected attribute in the HTML body <img width="974" height="670" alt="image" src="https://github.com/user-attachments/assets/d442c235-71a5-4da9-a963-8cf4b8614745" />
Figure 2. JavaScript code execution <img width="974" height="291" alt="image" src="https://github.com/user-attachments/assets/01579f19-8e80-4fae-8516-5903370ee6d8" />
Credits Researcher: Dmitry Prokhorov (Positive Technologies)
Other sources
Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in version 6.2.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nuxt-og-imageto a version that resolves this vulnerability.Fixed in 6.2.5 - Upgrade
Upgrade
Nuxt OG Imageto a version that resolves this vulnerability.Fixed in 6.2.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34405?
CVE-2026-34405 is classified as a medium severity vulnerability due to its potential to enable reflected XSS attacks.
How do I fix CVE-2026-34405?
To fix CVE-2026-34405, update Nuxt OG Image to version 6.2.5 or later to eliminate the reflected XSS vulnerability.
What type of vulnerability is CVE-2026-34405?
CVE-2026-34405 is a reflected cross-site scripting (XSS) vulnerability that can be exploited through query parameter injection.
What versions of Nuxt OG Image are affected by CVE-2026-34405?
Versions of Nuxt OG Image prior to 6.2.5 are affected by CVE-2026-34405.
Can CVE-2026-34405 affect user data?
Yes, CVE-2026-34405 can potentially compromise user data by allowing attackers to execute malicious scripts in the context of the victim's browser.