CVE-2026-71320 HIGH

CVE-2026-71320: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Vendor Nuxt
Product nuxt
Weakness CWE-74
Published August 5, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.

Key dates

02Disclosure timeline

August 5, 2026 CVE published
August 6, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-37253 WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability CVE-2024-37442 WordPress Photo Gallery by Ays – Responsive Image Gallery plugin < 5.7.1 - HTML Injection vulnerability CVE-2023-6164 MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection CVE-2024-35728 WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability