CVE-2026-56317: Nuxt NoScript Component XSS Vulnerability

CVE-2026-56317 Overview

CVE-2026-56317 is a cross-site scripting (XSS) vulnerability [CWE-79] affecting the Nuxt web framework. The flaw exists in the NoScript component, which writes slot content directly to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data passed into NoScript slots, such as route.query parameters. The injected payload executes in the document context when the noscript tag is implicitly closed by script tags. Nuxt versions before 4.4.7 and 3.x versions before 3.21.7 are affected.

Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser session by supplying crafted query parameters or other untrusted input that flows into NoScript slot content.

Affected Products

Nuxt versions before 4.4.7
Nuxt 3.x branch versions before 3.21.7
Applications using the <NoScript> component with untrusted slot content

Discovery Timeline

2026-06-20 - CVE-2026-56317 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56317

Vulnerability Analysis

The vulnerability resides in the NoScript component implementation in packages/nuxt/src/head/runtime/components.ts. The runtime assigned slot text content to the noscript element using innerHTML, which parses the assigned string as HTML. When developers pass user-controlled data, such as route.query parameters, into a NoScript slot, attacker-supplied markup is interpreted by the browser rather than treated as text. Browsers also implicitly close a noscript tag when encountering <script> tags within its content under certain parsing conditions. This behavior allows injected scripts to escape the noscript boundary and execute in the document context.

Root Cause

The root cause is the use of innerHTML for rendering slot content that may originate from untrusted sources. The component did not escape or sanitize input before assignment. Combined with HTML parsing quirks around noscript, attacker-controlled strings can be transformed into executable script nodes.

Attack Vector

An attacker crafts a URL containing a malicious payload in a query parameter consumed by a Nuxt application that renders the value inside a <NoScript> slot. When a victim visits the URL, the payload is injected into the DOM via innerHTML and executed. User interaction (visiting the link) is required, and exploitation depends on application-specific use of the affected component.

typescript

// Security patch - escape <NoScript> slot content
// Source: https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e
        }
      }
      if (textContent.length > 0) {
-        noscript.innerHTML = textContent.join('')
+        noscript.textContent = textContent.join('')
      }
      input.noscript![idx] = noscript
      update()

The fix replaces noscript.innerHTML with noscript.textContent, ensuring slot content is treated as plain text rather than parsed as HTML.

Detection Methods for CVE-2026-56317

Indicators of Compromise

HTTP requests containing <script>, <svg>, or event-handler payloads in query string parameters reaching Nuxt routes
Unexpected outbound requests from browser sessions to attacker-controlled domains following navigation to crafted URLs
Client-side errors or anomalous DOM mutations on pages rendering <NoScript> content

Detection Strategies

Inventory applications using vulnerable Nuxt versions (< 4.4.7 and < 3.21.7) via dependency manifests such as package.json and package-lock.json
Perform static code review for usages of <NoScript> with dynamic slot bindings referencing route.query, useRoute(), or other untrusted sources
Configure a Content Security Policy (CSP) and monitor report-uri or report-to endpoints for script-src violations on Nuxt-rendered pages

Monitoring Recommendations

Log and inspect web application firewall (WAF) events flagging HTML or script tags in query parameters destined for Nuxt endpoints
Track Software Composition Analysis (SCA) findings for nuxt package versions across CI/CD pipelines
Monitor browser telemetry and runtime application self-protection (RASP) signals for DOM-based script execution originating from user-controlled URL data

How to Mitigate CVE-2026-56317

Immediate Actions Required

Upgrade Nuxt to version 4.4.7 or later, or to 3.21.7 or later for the 3.x branch
Audit application code for <NoScript> slots that bind to user-controllable inputs and remove or sanitize such bindings
Deploy a strict Content Security Policy that restricts inline script execution to limit XSS impact

Patch Information

The Nuxt maintainers released fixes in commits 4b054e9 and 7fea9fd, which replace innerHTML with textContent for NoScript slot rendering. Additional details are available in the GitHub Security Advisory GHSA-m3q2-p4fw-w38m and the VulnCheck Cross-Site Scripting Advisory.

Workarounds

Avoid passing untrusted data such as route.query values into <NoScript> slots
Manually escape or sanitize any dynamic content before placing it inside <NoScript> until the patch can be applied
Implement a strict CSP with script-src 'self' to reduce the impact of injected scripts

bash

# Upgrade Nuxt to a fixed release
npm install nuxt@^4.4.7
# or for the 3.x branch
npm install nuxt@^3.21.7

# Verify installed version
npm ls nuxt