CVE-2026-71320 in Nuxt
Summary
by MITRE • 08/06/2026
Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability affects the Nuxt.js framework version 3.4.0 through 3.21.10 and 4.5.1, representing a critical server-side template injection flaw that enables remote code execution in Nitro processes. The vulnerability stems from improper sanitization of template keys passed through props to dynamic components when vue.runtimeCompiler is enabled, creating an attack vector where malicious actors can inject arbitrary template code into the rendering pipeline. The issue specifically targets the __nuxt_island/ endpoint which handles dynamic component rendering and allows attackers to manipulate template execution contexts.
The technical flaw occurs within the framework's server-side rendering mechanism when vue.runtimeCompiler: true is configured in the application settings, enabling runtime template compilation capabilities that are typically intended for development environments. Attackers can exploit this by crafting malicious props data containing template key injections that bypass normal input validation checks, ultimately allowing template code execution within the Nitro process context. This represents a direct violation of secure coding principles and demonstrates a failure in proper input sanitization and template escaping mechanisms.
The operational impact of this vulnerability is severe as it enables arbitrary code execution on the server hosting the Nuxt application when specific conditions are met. Remote attackers can leverage this flaw to execute malicious payloads, potentially leading to full system compromise, data exfiltration, or further lateral movement within network environments. The vulnerability affects both version 3.x and 4.x branches of the framework, indicating a widespread issue that impacts numerous applications using Nuxt.js for server-side rendering. This aligns with CWE-94 - Improper Control of Generation of Code ('Code Injection') and represents a critical security gap in template handling.
Mitigation strategies should focus on immediate version upgrades to 3.21.10 or 4.5.1 where the vulnerability is patched, along with implementing proper input validation and sanitization for all dynamic component props. Organizations should disable vue.runtimeCompiler: true in production environments unless absolutely necessary, as this feature significantly increases attack surface. Security measures including web application firewalls and runtime monitoring should be implemented to detect potential exploitation attempts. The fix addresses the core issue by implementing proper template key validation and ensuring that user-provided data cannot influence template compilation processes, aligning with ATT&CK technique T1590 - Indicator Removal on Host and T1059 - Command and Scripting Interpreter.
This vulnerability demonstrates the critical importance of secure template handling in modern web frameworks and highlights how development-time features can introduce production security risks when improperly configured. The issue serves as a reminder that server-side rendering capabilities, while powerful for performance optimization, require careful security consideration and proper configuration management to prevent exploitation by malicious actors targeting template injection vulnerabilities in Node.js based applications.