Answer in brief
CVE-2026-56317 records a Low severity (CVSS 6.1) vulnerability in Cross-site scripting via <NoScript> slot content in Nuxt's head components. The current sources do not mark it as known exploited. The current feed maps nuxt (npm), nuxt (npm), nuxt (npm), nuxt (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps nuxt (npm), nuxt (npm), nuxt (npm), nuxt (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| nuxtnpm | >=4.0.0 <4.4.7 | 4.4.7 |
| nuxtnpm | >=0 <3.21.7 | 3.21.7 |
| nuxtnpm | >=4.0.0,<4.4.7 | 4.4.7 |
| nuxtnpm | <3.21.7 | 3.21.7 |
Published upstream
Jun 2, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
### Impact Nuxt's globally registered `<NoScript>` component (from `@unhead/vue` head components, re-exported by Nuxt) wrote its default-slot content to the `innerHTML` of the `<noscript>` head tag, bypassing the HTML escaping that `{{ }}` interpolation normally applies in Vue templates. Applications that placed untrusted, attacker-controllable data inside a `<NoScript>` slot, for example: ```vue <NoScript>{{ route.query.banner }}</NoScript> ``` would emit that value unescaped inside `<noscript>` in the server-rendered HTML. With scripting enabled, the HTML parser treats `<noscript>` content in `<head>` under the "in head noscript" insertion mode: any tag other than `link`, `meta`, `noframes`, or `style` implicitly closes `<noscript>` and is re-processed in the head. A payload such as `<script>...</script>` therefore escapes the element and executes in the document context. Sibling head components (`<Style>`, `<Title>`) were not affected because they already routed slot text through the safe `textContent` path. ### Affected versions All currently supported versions of `nuxt` that ship the `<NoScript>` global component. ### Patches Fixed in `[email protected]` (commit [`4b054e9d`](https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e)) and backported to `[email protected]` (commit [`7fea9fd6`](https://github.com/nuxt/nuxt/commit/7fea9fd687f1dacbfb63db5fae5839896b017a0e)). The fix escapes `<NoScript>` slot content with `escapeHtml` from `@vue/shared` and writes it to `textContent` rather than `innerHTML`. Slot content is now rendered as text; intentional markup inside `<NoScript>` is no longer parsed as HTML. ### Workarounds Until you can upgrade: - Do not interpolate untrusted input into `<NoScript>` slots. Replace `<NoScript>{{ x }}</NoScript>` with a static string, or sanitise / HTML-escape `x` at the source. - If you must render dynamic noscript content, write the tag yourself via `useHead({ noscript: [{ textContent: escapedValue }] })` after escaping `escapedValue`. ### Credit Reported to Anthropic's coordinated vulnerability disclosure pipeline by Claude (Anthropic's AI assistant) and triaged by the Anthropic security team. Reference: ANT-2026-4NJYDFFM. Independently reported by [@alcls01111](https://github.com/alcls01111) via GitHub's coordinated disclosure flow (`GHSA-8grp-wcq9-925q`), closed as a duplicate of this advisory.
Quoted source text, attributed separately from HOL analysis.