CVE-2026-56697
- Source
- https://cve.org/CVERecord?id=CVE-2026-56697
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-56697.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-56697
- Aliases
- Published
- 2026-06-22T21:04:53Z
- Modified
- 2026-10-22T10:33:50Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp
- Details
-
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. Attackers can inject paths like //evil.com to redirect users to attacker-controlled hosts, enabling phishing and OAuth authorization-code theft.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-601" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56697.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56697.json
- https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3
- https://nvd.nist.gov/vuln/detail/CVE-2026-56697
- https://www.vulncheck.com/advisories/nuxt-open-redirect-via-protocol-relative-paths-in-reloadnuxtapp
- https://github.com/nuxt/nuxt/commit/6497d99dd106254abd089f6a263d7773869a343b
- https://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1
Affected packages
Git / github.com/nuxt/nuxt
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nuxt/nuxt
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0" }, { "fixed": "3.21.7" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.0.0" }, { "fixed": "4.4.7" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "6497d99dd106254abd089f6a263d7773869a343b" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "e447a793c47766834f7497f8412a76cd56fd8ee1" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
3.*
3.1.1
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.1.2
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.11.0
v3.11.1
v3.11.2
v3.12.0
v3.12.1
v3.12.2
v3.12.3
v3.12.4
v3.13.0
v3.13.1
v3.13.2
v3.14.0
v3.14.159
v3.14.1592
v3.15.0
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.16.0
v3.16.1
v3.16.2
v3.17.0
v3.17.1
v3.17.2
v3.17.3
v3.17.4
v3.17.5
v3.17.6
v3.17.7
v3.18.0
v3.18.1
v3.19.0
v3.19.1
v3.19.2
v3.19.3
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.20.0
v3.20.1
v3.20.2
v3.21.0
v3.21.1
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.8.0
v3.8.1
v3.8.2
v3.9.0
v3.9.1
v3.9.2
v3.9.3
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6