Nuxt Server-Side RCE via Runtime Template Injection in Server Island Props (CVE-2026-7320)

Vulnerability Overview Vulnerability Name: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props Vulnerability ID: GHSA-9473-5f9j-94wq CVE ID: CVE-2026-7320 CVSS Score: 8.1 / 10 Publication Date: Last week Author: danielroe Impact Scope Affected Versions: - Nuxt >= 4.0.0 = 3.4.0 < 3.21.10 Vulnerability Type: Server-side Remote Code Execution Attack Vector: Network Attack Complexity: High Required Privileges: None User Interaction: None Confidentiality Impact: Unchanged Integrity Impact: High Availability Impact: High Remediation Fixed Versions: - Nuxt 4.5.1 - Nuxt 3.21.10 Temporary Workarounds: 1. Ensure is set to (default value). 2. Do not pass unvalidated props such as or to island components. 3. As a defense-in-depth measure, deploy WAF rules to URL-decode and parse JSON query parameters in , blocking any object property named or . POC Code Additional Information Vulnerability Description: Nuxt server islands accept props via the endpoint. When is enabled (disabled by default), and the application has a server island component that forwards props to Vue's dynamic component resolution ( or ), an attacker can inject a key into island props to achieve server-side remote code execution. Common Configuration Meeting Preconditions: - exposes a polymorphic prop through its underlying primitives, which is forwarded to Vue's dynamic component resolution. - Island URL hashes are deterministic (unsigned) content hashes, not authentication tokens. Mitigating Factors: - is disabled by default in Nuxt. - Exploitation requires a second precondition: the application must have a server island component that places attacker-controlled values into the dynamic component path. - SSG/static deployments are largely unaffected by this vector. - Island component names are limited by build-time component registration. Patch Details: - When is enabled, island requests with decoded props containing a key will be rejected, returning HTTP 400 along with diagnostic information. - The fix has been applied to and backported to . Workarounds: - Upgrade to or . - Ensure is set to . - Do not pass unvalidated props to island components. - Deploy WAF rules as a defense-in-depth measure. References Vue Security Guide Nuxt Server Islands documentation

Goal Reached Thanks to every supporter — we hit 100%!

Nuxt Server-Side RCE via Runtime Template Injection in Server Island Props (CVE-2026-7320)

More from this source