CVE-2026-56698: Nuxt - Cross-Site Scripting via navigateTo open Option
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin when user-controlled input is passed to navigateTo.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nuxtto a version that resolves this vulnerability.Fixed in 4.4.7 - Upgrade
Upgrade
Nuxtto a version that resolves this vulnerability.Fixed in 3.21.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56698?
The severity of CVE-2026-56698 is medium with a score of 6.1.
How do I fix CVE-2026-56698?
To fix CVE-2026-56698, upgrade Nuxt to version 4.4.7 or 3.21.7 or later.
What types of attacks does CVE-2026-56698 allow?
CVE-2026-56698 allows cross-site scripting (XSS) attacks through client-side script execution.
Which versions of Nuxt are affected by CVE-2026-56698?
CVE-2026-56698 affects Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7.
What can attackers achieve by exploiting CVE-2026-56698?
By exploiting CVE-2026-56698, attackers can execute arbitrary JavaScript in the application's origin.