{"id":"EUVD-2026-38378","enisaUuid":"476f272a-87ef-3bcb-abcd-d4cf34e6a60d","description":"Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. Attackers can inject paths like //evil.com to redirect users to attacker-controlled hosts, enabling phishing and OAuth authorization-code theft.","datePublished":"Jun 22, 2026, 9:04:53 PM","dateUpdated":"Jun 23, 2026, 1:51:01 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3\nhttps://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1\nhttps://github.com/nuxt/nuxt/commit/6497d99dd106254abd089f6a263d7773869a343b\nhttps://www.vulncheck.com/advisories/nuxt-open-redirect-via-protocol-relative-paths-in-reloadnuxtapp\n","aliases":"CVE-2026-56697\nGHSA-g898-grjx-8jm3\n","assigner":"VulnCheck","epss":0.34,"enisaIdProduct":[{"id":"dd5432fa-1191-3f9d-8634-5d4c2fd64a54","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"4.0.0 \u003c4.4.7"},{"id":"ed3fac67-9485-36ba-bf6f-b67e14cc01f9","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"0 \u003c3.21.7"}],"enisaIdVendor":[{"id":"cdfb8a4e-0c09-393c-9702-288787e4ea8b","vendor":{"name":"nuxt"}}],"enisaIdVulnerability":[{"id":"26a4f6d9-d531-3b97-b504-e6127c133a7e","vulnerability":{"id":"GHSA-g898-grjx-8jm3","description":"Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. Attackers can inject paths like //evil.com to redirect users to attacker-controlled hosts, enabling phishing and OAuth authorization-code theft.","datePublished":"Jun 23, 2026, 12:30:29 AM","dateUpdated":"Jun 23, 2026, 12:30:29 AM","baseScore":0.0,"references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56697\nhttps://github.com/nuxt/nuxt/commit/6497d99dd106254abd089f6a263d7773869a343b\nhttps://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1\nhttps://www.vulncheck.com/advisories/nuxt-open-redirect-via-protocol-relative-paths-in-reloadnuxtapp\n","enisa_id":"EUVD-2026-38378\n","aliases":"CVE-2026-56697\nGHSA-g898-grjx-8jm3\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a8e6fe48-4827-3a76-8d26-57e85710c85e","vulnerability":{"id":"CVE-2026-56697","description":"Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. Attackers can inject paths like //evil.com to redirect users to attacker-controlled hosts, enabling phishing and OAuth authorization-code theft.","datePublished":"Jun 22, 2026, 9:04:53 PM","dateUpdated":"Jun 23, 2026, 1:51:01 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3\nhttps://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1\nhttps://github.com/nuxt/nuxt/commit/6497d99dd106254abd089f6a263d7773869a343b\nhttps://www.vulncheck.com/advisories/nuxt-open-redirect-via-protocol-relative-paths-in-reloadnuxtapp\n","enisa_id":"EUVD-2026-38378\n","assigner":"VulnCheck","epss":0.34,"dataProcessed":"Nov 1, 2026, 7:17:53 AM","vulnerabilityProduct":[{"id":"195bf3d6-7e16-3bce-8140-bcc6260ef0c7","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"0 \u003c3.21.7"},{"id":"bca03f85-93d7-3403-b9c3-267695f69872","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"4.0.0 \u003c4.4.7"}],"vulnerabilityVendor":[{"id":"c98dbefa-6878-358a-bb09-694625264f03","vendor":{"name":"nuxt"}}]}}],"enisaIdAdvisory":[]}