Cross-site Scripting (XSS)

nuxt is vulnerable to cross-site scripting XSS attacks. The library unsafely renders the stack trace within errors, which allows an attacker to inject and execute malicious JavaScript via a specifically crafted URL request...

Cross-site Scripting (XSS)

nuxt is vulnerable to cross-site scriptingXSS attacks. A malicious user is able to pass a specifically crafted URL with no protocol or search parameters through the getPayloadURL function and execute harmful JavaScript on the target system. The vulnerability currently exists only on prerendered...

CVE-2022-4414

Cross-site Scripting XSS - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

CVE-2022-4413

Cross-site Scripting XSS - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

Nuxt.js 跨站脚本漏洞

Nuxt.js is an open source web application framework based on Vue.js, Node.js, Webpack and Babel.js. A security vulnerability exists in versions prior to Nuxt.js v3.0.0-rc.13. An attacker exploited the vulnerability to execute a cross-site scripting attack...

PT-2022-27116 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to 3.0.0-rc.13 Description: The issue is related to Cross-site Scripting XSS - Reflected. This is a type of security vulnerability that occurs when an application includes user input in its responses without...

CVE-2022-4414

CVE-2022-4414 is a DOM-based XSS in Nuxt.js / nuxt/framework prior to v3.0.0-rc.13. The issue stems from the _getPayloadURL path, where URL parsing and host/params checks can be bypassed, enabling a crafted URL to execute injected JavaScript on prerendered sites. Public details consistently descr...

CVE-2022-4414 Cross-site Scripting (XSS) - DOM in nuxt/framework

Cross-site Scripting XSS - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

CVE-2022-4413 Cross-site Scripting (XSS) - Reflected in nuxt/framework

Cross-site Scripting XSS - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

PT-2022-27120 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to 3.0.0-rc.13 Description: The issue is related to Cross-site Scripting XSS - DOM, which allows an attacker to inject malicious scripts into a website. This can lead to unauthorized access to sensitive data or...

CVE-2022-4413 Cross-site Scripting (XSS) - Reflected in nuxt/framework

Cross-site Scripting XSS - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

CVE-2022-4414 Cross-site Scripting (XSS) - DOM in nuxt/framework

Cross-site Scripting XSS - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

CVE-2022-4414 Cross-site Scripting (XSS) - DOM in nuxt/framework

Cross-site Scripting XSS - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

CVE-2022-4413 Cross-site Scripting (XSS) - Reflected in nuxt/framework

Cross-site Scripting XSS - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13...

CVE-2022-4413

The CVE-2022-4413 issue concerns the Nuxt.js framework (nuxt/framework) prior to version 3.0.0-rc.13, where a reflected XSS vulnerability exists in the handling of error/stack traces. The root cause is unsafe rendering of stack traces (via v-html/$stack) in error templates, allowing an attacker t...

Filepath of page components of deploying system leaks in source code

Description When building your Nuxt application, the source file path of all page components is written in the entry.js file and is thus human readable to everyone. This could lead to unwanted side effects, as in revealing the structure of the system which was used to build the application or...

Dev Server XSS

Description The developer server unsafely renders the stack trace within errors. This can be manipulated by sending a specially crafted request. Root Cause The error-dev.vuetemplate, within @nuxt\ui-templates uses the v-html directive to render the stacktrace section of the error. vue This would...

Malicious Package

Overview theblock-ssr-nuxt is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

PT-2022-20219 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to the fixed version Description: The issue is related to Cross-site Scripting XSS - Generic. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents...

Path traversal in unjs/storage leads to code injection due to unsanitzed code generation

Path Traversal A path traversal vulnerability exists within unjs/unstorage when using the file system storage driver. This vulnerability can be exploited when the user has control over the key name. By creating key names containing sequences of ../ or ..: we can navigate the file system. We are...