{"items":[{"id":"NVI-00010111","kind":"vulnerability","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xfq5-w38q-pc2x","CVE-2026-114133"],"plain_summary":"GitHub lists this reviewed advisory for nuxt. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-162c7fa72fd3d83b40ec31c5f899a17a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.6.2 for nuxt. Confirm the publisher’s latest guidance.","source_ids":["sr-4cabfd1472b9e0d8231f26f8d3068ae2"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-22T16:58:02.000Z","value":"5.4 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-162c7fa72fd3d83b40ec31c5f899a17a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-162c7fa72fd3d83b40ec31c5f899a17a","url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xfq5-w38q-pc2x","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"},{"id":"sr-4cabfd1472b9e0d8231f26f8d3068ae2","url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-xfq5-w38q-pc2x","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-05T19:05:40.208Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-162c7fa72fd3d83b40ec31c5f899a17a"],"technology":"nuxt","known_exclusions":[],"conditions_summary":"## Impact\n\n`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `` tags are only kept for JSON types.\n\nWhen `useHeadSafe` is called inside a server island (a `.server.vue` component or page, or a component rendered with ``), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. `` then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.\n\nAs a result, input that `useHeadSafe` would normally strip (such as `bodyAttrs.onload` or executable `` content) is rendered into the page. If an application passes user-controlled data to `useHeadSafe` inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.\n\n```vue\n\n\nconst { data: author } = await useFetch('/api/author')\n// author.value.head is user-authored, e.g. { bodyAttrs: { onl","public_affected_ranges":[">= 3.13.0, < 4.6.2"]},{"certainty":"source_listed","source_ids":["sr-4cabfd1472b9e0d8231f26f8d3068ae2"],"technology":"nuxt","known_exclusions":[],"conditions_summary":"## Impact\n\n`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `` tags are only kept for JSON types.\n\nWhen `useHeadSafe` is called inside a server island (a `.server.vue` component or page, or a component rendered with ``), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. `` then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.\n\nAs a result, input that `useHeadSafe` would normally strip (such as `bodyAttrs.onload` or executable `` content) is rendered into the page. If an application passes user-controlled data to `useHeadSafe` inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.\n\n```vue\n\n\nconst { data: author } = await useFetch('/api/author')\n// author.value.head is user-authored, e.g. { bodyAttrs: { onl","public_affected_ranges":["SEMVER: introduced 3.13.0; fixed 4.6.2"]}],"null_published_at":"2026-11-07T00:57:04.325Z","source_updated_at":"2026-10-22T16:58:02.000Z","source_disclosed_at":"2026-10-22T16:58:00.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T22:07:30.906Z"},{"id":"NVI-00010111","kind":"vulnerability","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xfq5-w38q-pc2x","CVE-2026-114133"],"plain_summary":"GitHub lists this reviewed advisory for nuxt. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-162c7fa72fd3d83b40ec31c5f899a17a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-22T16:58:02.000Z","value":"5.4 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-162c7fa72fd3d83b40ec31c5f899a17a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-162c7fa72fd3d83b40ec31c5f899a17a","url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xfq5-w38q-pc2x","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-162c7fa72fd3d83b40ec31c5f899a17a"],"technology":"nuxt","known_exclusions":[],"conditions_summary":"## Impact\n\n`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `` tags are only kept for JSON types.\n\nWhen `useHeadSafe` is called inside a server island (a `.server.vue` component or page, or a component rendered with ``), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. `` then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.\n\nAs a result, input that `useHeadSafe` would normally strip (such as `bodyAttrs.onload` or executable `` content) is rendered into the page. If an application passes user-controlled data to `useHeadSafe` inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.\n\n```vue\n\n\nconst { data: author } = await useFetch('/api/author')\n// author.value.head is user-authored, e.g. { bodyAttrs: { onl","public_affected_ranges":[">= 3.13.0, < 4.6.2"]}],"null_published_at":"2026-10-31T22:13:48.415Z","source_updated_at":"2026-10-22T16:58:02.000Z","source_disclosed_at":"2026-10-22T16:58:00.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:30.906Z"}],"next_cursor":null,"snapshot_revision":"42594"}