Nuxt server islands render `useHeadSafe` input without sanitisation

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .

Source published

21 Oct 2026 17:52:09 UTC

Source modified

28 Oct 2026 17:23:40 UTC

Observed here

28 Oct 2026 18:46:48 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .

Source published

Oct 21, 2026, 5:52:09 PM (timezone not stated)

Source modified

Oct 28, 2026, 5:23:40 PM (timezone not stated)

Observed here

7 Nov 2026 04:35:52 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .

Source published

21 Oct 2026 18:17:26 UTC

Source modified

28 Oct 2026 18:17:10 UTC

Observed here

29 Oct 2026 06:48:04 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

## Impact `useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `<script>` tags are only kept for JSON types. When `useHeadSafe` is called inside a server island (a `.server.vue` component or page, or a component rendered with `<NuxtIsland>`), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. `<NuxtIsland>` then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client. As a result, input that `useHeadSafe` would normally strip (such as `bodyAttrs.onload` or executable `<script>` content) is rendered into the page. If an application passes user-controlled data to `useHeadSafe` inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin. ```vue <!-- components/AuthorMeta.server.vue --> <script setup lang="ts"> const { data: author } = await useFetch('/api/author') // author.value.head is user-authored, e.g. { bodyAttrs: { onload: '...' } } useHeadSafe(author.value.head) </script> ``` ## Mitigating factors - Server components are experimental. They are only active when the application defines a `.server.vue` component or page, or enables `experimental.componentIslands` and renders `<NuxtIsland>`. - Exploitation requires the application to pass attacker-controlled data to `useHeadSafe` inside a server island. `useHeadSafe` called from regular (non-island) components and pages is not affected. ## Affected versions `nuxt` `>=3.13.0`, when head support for server islands was introduced. Nuxt 2 is not affected. ## Patches Fixed in `[email protected]`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix. Patched releases apply Unhead's safe input filtering to `useHeadSafe` entries on the server before they are added to the island response, so `islandResponse.head` (including what `render:island` hooks see) only contains input that `useHeadSafe` allows. ## Workarounds Upgrade to `[email protected]`. If you cannot upgrade, including on Nuxt 3: 1. Call `useHeadSafe` with untrusted input from a regular component or page rather than from inside a server island. 2. Alternatively, validate untrusted head input against your own allowlist before passing it to `useHeadSafe` inside a server island.

Source published

22 Oct 2026 16:58:00 UTC

Source modified

22 Oct 2026 17:15:04 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Publisher rating · MODERATE