Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114133— Nuxt server islands render `useHeadSafe` input without sanitisation

Quick assessment

Affected
nuxt nuxt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt 是一个面向 Vue.js 的开源 Web 开发框架。在版本 3.13.0 至 4.6.2 期间，服务器端岛屿（server-island）渲染器将原始的 输入直接序列化到岛屿响应中，但未保留其“安全输入”标记；随后，NuxtIsland 会将该输入作为普通条目插入页面头部。因此，若应用程序在 组件或页面中，或通过 NuxtIsland 渲染的组件中，将攻击者可控的数据传递给 ，则可能渲染出本应被白名单过滤的内容，包括事件处理器属性或可执行脚本内容，从而导致应用来源发生存储型跨站脚本攻击（Stored XS

CVSS 5.4 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
nuxt nuxt >= 3.13.0, < 4.6.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114133

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nuxt server islands render `useHeadSafe` input without sanitisation
Source: CVE Program / CVE List V5
Vulnerability Description
Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nuxt nuxt >= 3.13.0, < 4.6.2 -

II. Public POCs for CVE-2026-114133

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114133

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114133 (1)

Vendor Advisories for CVE-2026-114133 (1)

Vendor Pages for CVE-2026-114133 (1)

Same Patch Batch · nuxt · 2026-10-21 · 4 CVEs total

CVE-2026-114131 6.5 MEDIUM Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment c
CVE-2026-114132 6.3 MEDIUM Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case
CVE-2026-114130 2.3 LOW Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII c

IV. Related Vulnerabilities

Same product: nuxt
Same vendor: nuxt
Same weakness: CWE-79

V. Comments for CVE-2026-114133

No comments yet

Leave a comment