CVE-2026-34405: Nuxt OG Image XSS Vulnerability

CVE-2026-34405 Overview

CVE-2026-34405 is a Cross-Site Scripting (XSS) vulnerability in Nuxt OG Image, a module that generates Open Graph images using Vue templates in Nuxt applications. The vulnerability exists in the image-generation component accessible through the /_og/d/ URI endpoint (and /og-image/ in older versions), which allows attackers to inject arbitrary attributes into the HTML page body. This type of attribute injection can lead to various XSS attack scenarios where malicious scripts may execute in users' browsers.

Critical Impact

Attackers can inject arbitrary HTML attributes through the OG Image generation endpoints, potentially enabling Cross-Site Scripting attacks that could compromise user sessions, steal sensitive data, or perform unauthorized actions on behalf of authenticated users.

Affected Products

• Nuxt OG Image versions prior to 6.2.5
• Nuxt applications using the /_og/d/ endpoint
• Nuxt applications using the legacy /og-image/ endpoint

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-34405 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34405

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in how the Nuxt OG Image module processes user-supplied input when generating Open Graph images through its exposed endpoints.

The affected endpoints (/_og/d/ and /og-image/) fail to properly sanitize or validate input parameters before incorporating them into the rendered HTML page. This oversight allows an attacker to craft malicious requests containing arbitrary HTML attributes that are directly injected into the page body without proper escaping or encoding.

The network-based attack vector requires user interaction, meaning a victim must be tricked into accessing a specially crafted URL. However, once triggered, the vulnerability can bypass same-origin restrictions due to its changed scope characteristic, potentially affecting resources beyond the vulnerable component's security domain.

Root Cause

The root cause is improper input validation and insufficient output encoding in the image-generation component. When processing requests to the OG image endpoints, the module fails to sanitize user-controlled parameters before reflecting them in the HTML response. This lack of input sanitization allows specially crafted attribute values to break out of their intended context and inject new attributes or event handlers into the HTML document.

Attack Vector

The attack is conducted over the network by crafting malicious URLs that target the vulnerable OG image generation endpoints. An attacker would construct a URL containing malicious attribute payloads and distribute it to potential victims through phishing emails, social media, or compromised websites.

When a victim clicks the malicious link, the vulnerable Nuxt OG Image component processes the request and renders the attacker-controlled content directly into the HTML page body. This can result in the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking, credential theft, or other malicious activities.

The vulnerability can be exploited by manipulating URL parameters or request data sent to the /_og/d/ or /og-image/ endpoints. The injected attributes could include JavaScript event handlers such as onload, onerror, or onclick that execute attacker-controlled scripts when the page renders.

Detection Methods for CVE-2026-34405

Indicators of Compromise

• Unusual requests to /_og/d/ or /og-image/ endpoints containing HTML special characters or JavaScript event handlers
• Web server logs showing requests with encoded payloads targeting OG image generation paths
• Client-side reports of unexpected script execution or browser security warnings when accessing OG image URLs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing HTML attribute injection patterns targeting the affected endpoints
• Monitor application logs for requests to /_og/d/ and /og-image/ paths with suspicious parameter values containing characters like <, >, ", or on* event handlers
• Deploy Content Security Policy (CSP) headers to detect and report violations that may indicate XSS exploitation attempts

Monitoring Recommendations

• Enable verbose logging on the Nuxt application to capture all requests to OG image generation endpoints
• Set up alerting for anomalous traffic patterns or request volumes to the vulnerable URI paths
• Review browser console reports and CSP violation logs for evidence of script injection attempts

How to Mitigate CVE-2026-34405

Immediate Actions Required

• Upgrade Nuxt OG Image to version 6.2.5 or later immediately
• If immediate patching is not possible, consider temporarily disabling or restricting access to the /_og/d/ and /og-image/ endpoints
• Implement input validation and output encoding at the application or WAF level as a defense-in-depth measure

Patch Information

The vulnerability has been patched in Nuxt OG Image version 6.2.5. Organizations using affected versions should update to this version or later as soon as possible. For detailed patch information and security advisory details, refer to the GitHub Security Advisory.

Workarounds

• Restrict access to the /_og/d/ and /og-image/ endpoints using network-level controls or reverse proxy rules until patching is complete
• Implement strict Content Security Policy headers to mitigate the impact of potential XSS attacks
• Deploy a WAF rule to sanitize or block requests containing potentially malicious HTML attribute patterns targeting the affected endpoints

# Example: Nginx configuration to restrict access to vulnerable endpoints
location ~ ^/(og-image|_og/d)/ {
    # Option 1: Block access entirely until patched
    # deny all;
    
    # Option 2: Restrict to internal networks only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}