Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.4%
probabilidade de exploração
0.4%top 64% das CVEs
exploração observada
nãonenhuma fonte reporta
Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
nuxt · nuxtReferências
https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859https://github.com/nuxt/nuxt/releases/tag/v3.21.10https://github.com/nuxt/nuxt/releases/tag/v4.5.1https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq