EUVD-2026-53649

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

CVE-2026-71320

Nuxt (Vue.js framework) has a vulnerability affecting versions 3.4.0–3.21.10 and 4.5.1 where an attacker can inject a template key via /__nuxt_island/ props into a dynamic component if vue.runtimeCompiler is enabled, leading to template execution in the Nitro process. This is fixed in 3.21.10 and...

CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...