{"id":"EUVD-2026-38379","enisaUuid":"7f202bb6-8b3a-3a71-9bc5-3ed7e7e9a00e","description":"Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application\u0027s origin when user-controlled input is passed to navigateTo.","datePublished":"Jun 22, 2026, 9:04:53 PM","dateUpdated":"Jun 23, 2026, 3:05:45 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3\nhttps://github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032\nhttps://github.com/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024d\nhttps://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-navigateto-open-option\n","aliases":"CVE-2026-56698\nGHSA-h345-75vh-jjwf\n","assigner":"VulnCheck","epss":0.41,"enisaIdProduct":[{"id":"046c34e7-33a2-3d8d-8596-edd5762c7d14","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"4.0.0 \u003c4.4.7"},{"id":"80584c03-2515-391c-8bc5-1e9e051104c8","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"0 \u003c3.21.7"}],"enisaIdVendor":[{"id":"97c3a902-f1ea-321f-a307-5738a00a9d57","vendor":{"name":"nuxt"}}],"enisaIdVulnerability":[{"id":"8f7e66b8-d161-3809-8da9-ecdf59357aaf","vulnerability":{"id":"CVE-2026-56698","description":"Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application\u0027s origin when user-controlled input is passed to navigateTo.","datePublished":"Jun 22, 2026, 9:04:53 PM","dateUpdated":"Jun 23, 2026, 3:05:45 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3\nhttps://github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032\nhttps://github.com/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024d\nhttps://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-navigateto-open-option\n","enisa_id":"EUVD-2026-38379\n","assigner":"VulnCheck","epss":0.41,"dataProcessed":"Nov 3, 2026, 7:17:08 AM","vulnerabilityProduct":[{"id":"6e47ee55-d19d-3412-ab76-0ba4dd4d29ae","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"0 \u003c3.21.7"},{"id":"a984c025-b035-3c53-84f4-4b70ad830fcd","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"4.0.0 \u003c4.4.7"}],"vulnerabilityVendor":[{"id":"f3f63a02-ad9a-300b-8136-c28e9fa7248b","vendor":{"name":"nuxt"}}]}},{"id":"95738ef7-82f2-3a12-b13e-61aaf4c9bfaa","vulnerability":{"id":"GHSA-h345-75vh-jjwf","description":"Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application\u0027s origin when user-controlled input is passed to navigateTo.","datePublished":"Jun 23, 2026, 12:30:29 AM","dateUpdated":"Jun 23, 2026, 12:30:29 AM","baseScore":0.0,"references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56698\nhttps://github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032\nhttps://github.com/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024d\nhttps://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-navigateto-open-option\n","enisa_id":"EUVD-2026-38379\n","aliases":"GHSA-h345-75vh-jjwf\nCVE-2026-56698\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}