AIKIDO-2026-858072
nuxt is vulnerable to Improper Input Validation
48
Medium Risk
This Affects:
nuxtTL;DR
Nuxt contains an improper input validation vulnerability in server islands that can allow an attacker to instantiate arbitrary globally registered Vue components or native HTML elements by supplying crafted props to dynamic component resolution (<component :is>, resolveDynamicComponent, or h()). This can bypass intended component restrictions and may expose unintended functionality or information. The vulnerability does not require vue.runtimeCompiler and affects applications that forward untrusted island props into dynamic component resolution.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use a server island component whose root is a polymorphic component that forwards an undeclared as prop into Vue's dynamic component resolution.
Background info
nuxt is vulnerable to Improper Input Validation in versions 3.1.0 - 3.21.9 and 4.0.0 - 4.5.0.
How to fix this
Upgrade to a patched version. If this is not possible, avoid forwarding untrusted props to dynamic component resolution, use an allowlist of permitted components, explicitly declare accepted island props or set inheritAttrs: false, and avoid globally registering sensitive components.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant