AIKIDO-2026-414718

nuxt is vulnerable to Remote Code Execution (RCE)

Remote Code Execution (RCE)GHSA-9473-5f9j-94wq Published 5 days ago

High Risk

This Affects:

nuxt

3.4.0 - 3.21.9

Fixed in 3.21.10

4.0.0 - 4.5.0

Fixed in 4.5.1

Are you affected? Scan for Free

TL;DR

Nuxt contains a server-side remote code execution vulnerability when vue.runtimeCompiler is enabled and a server island forwards attacker-controlled props into Vue's dynamic component resolution. An attacker can inject a malicious template property through the /__nuxt_island/ endpoint, causing the Vue runtime compiler to compile and execute arbitrary code within the Nitro server process. The vulnerability requires a non-default configuration (vue.runtimeCompiler: true) and a vulnerable server island implementation, and does not affect static deployments or the default Nuxt configuration.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range, have vue.runtimeCompiler enabled, and expose a server island that forwards attacker-controlled props into dynamic component resolution. Static deployments and the default Nuxt configuration are not affected.

Background info

nuxt is vulnerable to Remote Code Execution (RCE) in versions 3.4.0 - 3.21.9 and 4.0.0 - 4.5.0.

How to fix this

Upgrade to a patched version. If this is not possible, disable vue.runtimeCompiler, avoid passing unsanitized user-controlled props to dynamic component resolution (<component :is>, resolveDynamicComponent, h()), and optionally deploy a WAF to block malicious template or render properties in island requests as a defense-in-depth measure.