GHSA-FP2W-G92G-FGQ4 @nuxtlabs/github-module made Use of Hard-coded Credentials

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes GitHub organizations. A patch in version 1.6.2 fixed the issue...

Github token with wide access to Nuxt related repositories leaked in the wild

Description If you visit https://nuxt.com, you will find hardcoded Github token in the source code of the page - ghpYXegsf40mjoFZMPSdntLbrGIBRZYKf0i2FoK. This token has access to multiple repositories under nuxt , nuxtlabs and nuxt-themes Github organisations. https://github.com/nuxt Admin...

Cross-site Scripting (XSS)

nuxt is vulnerable to cross-site scriptingXSS attacks. The vulnerability is due to prerendered sites, allowing an attacker to pass a specifically crafted URL through the getPayloadURL function and execute harmful JavaScript on the target system...

CVE-2023-0878

Cross-site Scripting XSS - Generic in GitHub repository nuxt/framework prior to 3.2.1...

PT-2023-16582 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to 3.2.1 Description: The issue is related to Cross-site Scripting XSS - Generic. This is a type of security vulnerability that occurs when an application includes user input in its output without proper validati...

CVE-2023-0878 Cross-site Scripting (XSS) - Generic in nuxt/framework

Cross-site Scripting XSS - Generic in GitHub repository nuxt/framework prior to 3.2.1...

CVE-2023-0878 Cross-site Scripting (XSS) - Generic in nuxt/framework

Cross-site Scripting XSS - Generic in GitHub repository nuxt/framework prior to 3.2.1...

CVE-2023-0878

Summary of CVE-2023-0878 (nuxt/framework). The issue is a Cross-site Scripting (XSS) vulnerability in nuxt/framework prior to 3.2.1, linked to prerendered sites. The root cause centers on how the payload URL is constructed via a function similar to _getPayloadURL, where URL parsing and pathname h...

XSS in user supplied title

Issue The useHead function does not sanitize tags inserted in each property, including the title property. Context The useHead repository is a wrapper around vueuse/head which wraps unjs/unhead which wraps harlan-zw/zhead. The possibility of XSS is not described as being a vulnerability in the ro...

CSS injection using component islands and useHead

Description After a component island render, the resulting head is regex'd for tags. This regex is not very robust and can be tricked, allowing for CSS injection. Proof of Concept app.vue vue Nuxt 3 Playground const title = ref nuxt.config.ts ts export default defineNuxtConfig experimental:...

Cross-site Scripting (XSS)

nuxt is vulnerable to cross-site scripting XSS attacks. The library unsafely renders the stack trace within errors, which allows an attacker to inject and execute malicious JavaScript via a specifically crafted URL request...

Cross-site Scripting (XSS)

nuxt is vulnerable to cross-site scriptingXSS attacks. A malicious user is able to pass a specifically crafted URL with no protocol or search parameters through the getPayloadURL function and execute harmful JavaScript on the target system. The vulnerability currently exists only on prerendered...

CVE-2022-4414

Cross-site Scripting XSS - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

CVE-2022-4413

Cross-site Scripting XSS - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

Nuxt.js 跨站脚本漏洞

Nuxt.js is an open source web application framework based on Vue.js, Node.js, Webpack and Babel.js. A security vulnerability exists in versions prior to Nuxt.js v3.0.0-rc.13. An attacker exploited the vulnerability to execute a cross-site scripting attack...

CVE-2022-4414 Cross-site Scripting (XSS) - DOM in nuxt/framework

Cross-site Scripting XSS - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

PT-2022-27116 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to 3.0.0-rc.13 Description: The issue is related to Cross-site Scripting XSS - Reflected. This is a type of security vulnerability that occurs when an application includes user input in its responses without...

CVE-2022-4413 Cross-site Scripting (XSS) - Reflected in nuxt/framework

Cross-site Scripting XSS - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

PT-2022-27120 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to 3.0.0-rc.13 Description: The issue is related to Cross-site Scripting XSS - DOM, which allows an attacker to inject malicious scripts into a website. This can lead to unauthorized access to sensitive data or...

CVE-2022-4414

CVE-2022-4414 is a DOM-based XSS in Nuxt.js / nuxt/framework prior to v3.0.0-rc.13. The issue stems from the _getPayloadURL path, where URL parsing and host/params checks can be bypassed, enabling a crafted URL to execute injected JavaScript on prerendered sites. Public details consistently descr...