CVE-2026-71320highCWE-74CWE-94

CVE-2026-71320: high-severity vulnerability in nuxt

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Published · Updated

Follow this CVE+ Monitor nuxt+ Monitor nuxt

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.7%
Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
nuxt · nuxt
Related CVEs — nuxt

In the same product, most dangerous first.

CVE-2024-23657HIGHPath Traversal: '../filedir' in Nuxt DevtoolsEPSS 1.2%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.9%CVE-2024-34344HIGHRemote code execution via the browser when running the test locally in nuxtEPSS 0.8%CVE-2026-71321HIGHNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationEPSS 0.7%CVE-2025-24360MEDIUMOpening a malicious website while running a Nuxt dev server could allow read-only access to codeEPSS 0.6%CVE-2026-71316HIGHNuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsEPSS 0.5%