CVE-2026-56698
- Source
- https://cve.org/CVERecord?id=CVE-2026-56698
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-56698.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-56698
- Aliases
- Published
- 2026-06-22T21:04:53Z
- Modified
- 2026-10-22T10:34:39Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Nuxt - Cross-Site Scripting via navigateTo open Option
- Details
-
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin when user-controlled input is passed to navigateTo.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56698.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56698.json
- https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3
- https://nvd.nist.gov/vuln/detail/CVE-2026-56698
- https://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-navigateto-open-option
- https://github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032
- https://github.com/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024d
Affected packages
Git / github.com/nuxt/nuxt
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nuxt/nuxt
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0" }, { "fixed": "3.21.7" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.0.0" }, { "fixed": "4.4.7" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "3394716d4a913cba904b028df5338f2aead50032" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "62fc32eddf648b00a3890141e0235d2a222b024d" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
3.*
3.1.1
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.1.2
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.11.0
v3.11.1
v3.11.2
v3.12.0
v3.12.1
v3.12.2
v3.12.3
v3.12.4
v3.13.0
v3.13.1
v3.13.2
v3.14.0
v3.14.159
v3.14.1592
v3.15.0
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.16.0
v3.16.1
v3.16.2
v3.17.0
v3.17.1
v3.17.2
v3.17.3
v3.17.4
v3.17.5
v3.17.6
v3.17.7
v3.18.0
v3.18.1
v3.19.0
v3.19.1
v3.19.2
v3.19.3
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.20.0
v3.20.1
v3.20.2
v3.21.0
v3.21.1
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.8.0
v3.8.1
v3.8.2
v3.9.0
v3.9.1
v3.9.2
v3.9.3
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6