{"id":"EUVD-2026-107417","enisaUuid":"ced1200d-6fbf-39cc-a5a1-e20f27f762ea","description":"Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .","datePublished":"Oct 21, 2026, 5:52:09 PM","dateUpdated":"Oct 21, 2026, 5:53:26 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x\nhttps://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0\nhttps://github.com/nuxt/nuxt/releases/tag/v4.6.2\n","aliases":"CVE-2026-114133\nGHSA-xfq5-w38q-pc2x\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"22259dee-3de4-3a8f-8bb4-594687c255a9","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"3.13.0, \u003c 4.6.2"}],"enisaIdVendor":[{"id":"909c19f7-8634-3f08-9754-a516a0fae9d8","vendor":{"name":"nuxt"}}],"enisaIdVulnerability":[{"id":"9b9a4119-7824-3326-9379-28017607a043","vulnerability":{"id":"GHSA-xfq5-w38q-pc2x","description":"Nuxt server islands render `useHeadSafe` input without sanitisation","datePublished":"Oct 22, 2026, 4:58:00 PM","dateUpdated":"Oct 22, 2026, 4:58:00 PM","baseScore":0.0,"references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114133\nhttps://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0\nhttps://github.com/nuxt/nuxt\nhttps://github.com/nuxt/nuxt/releases/tag/v4.6.2\n","enisa_id":"EUVD-2026-107417\n","aliases":"CVE-2026-114133\nGHSA-xfq5-w38q-pc2x\n","epss":0.0,"dataProcessed":"Oct 27, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c2d26aef-71d6-361b-a76b-559e8752ff5e","vulnerability":{"id":"CVE-2026-114133","description":"Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .","datePublished":"Oct 21, 2026, 5:52:09 PM","dateUpdated":"Oct 21, 2026, 5:53:26 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x\nhttps://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0\nhttps://github.com/nuxt/nuxt/releases/tag/v4.6.2\n","enisa_id":"EUVD-2026-107417\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 27, 2026, 7:14:58 AM","vulnerabilityProduct":[{"id":"a31ea914-b1ad-394a-8459-34b0063d01a9","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"3.13.0, \u003c 4.6.2"}],"vulnerabilityVendor":[{"id":"c7e91642-7718-3043-a77b-2632f96ae349","vendor":{"name":"nuxt"}}]}}],"enisaIdAdvisory":[]}