PT-2025-38250

Name of the Vulnerable Software and Affected Versions: Nuxt versions prior to 3.19.0 Nuxt versions prior to 4.1.0 Description: A client-side path traversal vulnerability exists in Nuxt's Island payload revival mechanism. This allows attackers to manipulate client-side requests to different...

Nuxt Icon < 1.4.5 Server-Side Request Forgery

Nuxt Icon versions prior to 1.4.5 are vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs in the icon fetching functionality. An attacker can exploit this vulnerability by providing a malicious URL that points to an internal or restricted resource,...

MAL-2025-43539 Malicious code in auriga-spectron-webdriver-nuxtjs-native (npm)

The package auriga-spectron-webdriver-nuxtjs-native was found to contain malicious code...

Malicious code in fornax-blitz-nuxtjs-spica (npm)

The package fornax-blitz-nuxtjs-spica was found to contain malicious code...

Malicious code in @bttr-devs/nuxt-layer-base (npm)

The package @bttr-devs/nuxt-layer-base was found to contain malicious code...

MAL-2025-7122 Malicious code in @bttr-devs/nuxt-layer-base (npm)

The package @bttr-devs/nuxt-layer-base was found to contain malicious code...

Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering

Summary A remote script-inclusion / stored XSS vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and...

GHSA-CJ6R-RRR9-FG82 Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering

Summary A remote script-inclusion / stored XSS vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and...

CVE-2025-54075 mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative...

Nuxt MDC 跨站脚本漏洞

Nuxt MDC is a Nuxt open source application that enhances regular Markdown. A cross-site scripting vulnerability exists in Nuxt MDC versions prior to 0.17.2, which stems from improper handling of Markdown and could lead to a stored cross-site scripting attack...

Malicious code in frontegg-nuxt-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dfeb24eb6c59e883dded7166ce9ff73fb43ab8352fcc2a154f86c7bf96be5e8 Any computer that has this package installed or running should be considered...

MAL-2025-4725 Malicious code in frontegg-nuxt-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dfeb24eb6c59e883dded7166ce9ff73fb43ab8352fcc2a154f86c7bf96be5e8 Any computer that has this package installed or running should be considered...

CVE-2025-24361

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script b...

CVE-2025-24360

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite...

CVE-2023-3224

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-0878

Cross-site Scripting XSS - Generic in GitHub repository nuxt/framework prior to 3.2.1...

CVE-2022-4413

Cross-site Scripting XSS - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

CVE-2022-4414

Cross-site Scripting XSS - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

CVE-2025-3019

KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existin...

CVE-2025-3019 Cross-site scripting vulnerabilities in KNIME Business Hub web pages

KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existin...