CVE-2026-102527— Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Quick assessment
Affected
nuxt-modules og-image
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nuxt OG Image 模块使用 Vue 模板在 Nuxt 应用中生成 Open Graph (OG) 图像。在版本 6.2.5 至 6.7.0 之间，动态路由 接受未经签名的请求，而 函数根据请求路径、站点 URL 以及通过图像 URL 和服务器响应暴露的标准化渲染选项生成缓存键。 未经验证的攻击者可以通过 参数提供其控制的图像数据，并结合由此推导出的缓存键，填充原本用于合法 Open Graph 图像的缓存槽位，从而导致向用户展示被伪造的图像内容。该问题已在版本 6.7.0 中修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nuxt-modules | og-image | >= 6.2.5, < 6.7.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102527
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Source: CVE Program / CVE List V5
Vulnerability Description
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在可信数据中接受外来的不可信数据
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nuxt-modules | og-image | >= 6.2.5, < 6.7.0 | - |
|
II. Public POCs for CVE-2026-102527
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102527
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-102527 (2)
Vendor Advisories for CVE-2026-102527 (1)
Vendor Pages for CVE-2026-102527 (1)
-
🔗 Release v6.7.0 · nuxt-modules/og-image · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: og-image
Same vendor: nuxt-modules
-
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` UR -
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 -
CVE-2026-34405
Nuxt OG Image vulnerable to reflected XSS via query paramete -
CVE-2026-34404
Nuxt OG Image vulnerable to DoS via image generation -
CVE-2025-54075
mdc vulnerable to XSS in markdown rendering bypassing HTML f
Same weakness: CWE-349
-
CVE-2026-100755
Acceptance of Extraneous Untrusted Data With Trusted Data in -
CVE-2026-48100
Payy: agg_agg trailing message slots are unconstrained and a -
CVE-2026-19033
Unauthenticated IXFR deltas are applied to the live zone bef -
CVE-2026-78301
Out-of-zone database nodes can become authoritative zone cut -
CVE-2026-15387
Acceptance of Extraneous Untrusted Data With Trusted Data in
V. Comments for CVE-2026-102527
No comments yet