{"items":[{"id":"NVI-00014025","kind":"vulnerability","title":"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-c9cv-mq2m-ppp3","CVE-2026-56326"],"plain_summary":"GitHub lists this reviewed advisory for nuxt, nuxt. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0f8da134b68a17fed83b7d1392e34ec7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-18T20:43:02.000Z","value":"6.1 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-339e847172514231b31c48f236be9cb2"},{"kind":"CVSS","as_of":"2026-10-25T23:10:00.167Z","value":"6.1 MEDIUM (3.1)","meaning":"disclosure@vulncheck.com severity; no combined Null risk score.","source_id":"sr-6364a73c7838ac73275e3ccab8029952"},{"kind":"CVSS","as_of":"2026-10-25T23:10:00.167Z","value":"5.3 MEDIUM (4.0)","meaning":"disclosure@vulncheck.com severity; no combined Null risk score.","source_id":"sr-6364a73c7838ac73275e3ccab8029952"},{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.362%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.30133. Missing scores are unknown.","source_id":"sr-0f8da134b68a17fed83b7d1392e34ec7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-339e847172514231b31c48f236be9cb2","url":"https://github.com/advisories/GHSA-c9cv-mq2m-ppp3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c9cv-mq2m-ppp3","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:31.527Z"},{"id":"sr-6364a73c7838ac73275e3ccab8029952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56326","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-56326","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:33.286Z"},{"id":"sr-0f8da134b68a17fed83b7d1392e34ec7","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-56326","publisher":"FIRST EPSS","observed_at":"2026-11-04T23:33:33.051Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-339e847172514231b31c48f236be9cb2"],"technology":"nuxt","known_exclusions":[],"conditions_summary":"### Summary\n\nThree weaknesses in Nuxt's client-navigation URL handling, all reachable\nfrom documented public APIs (`navigateTo` and `reloadNuxtApp`):\n\n1. **(CVE-2026-56326) SSR open redirect in `navigateTo` via path-normalisation bypass.** \n   `navigateTo` decided whether a target was external by inspecting the raw\n   input with `hasProtocol(..., { acceptRelative: true })`. Inputs such as\n   `/..//evil.com`, `/.//evil.com`, `/%2e%2e//evil.com`, or\n   `/app/..//evil.com` slipped past that check because they start with\n   `/`, but WHATWG URL parsing then normalised them to the\n   protocol-relative pathname `//evil.com`. The normalised value was\n   written to the `Location` response header and into the\n   `` body of the SSR redirect page, so a\n   victim's browser would resolve the redirect cross-origin to the\n   attacker's host.\n\n2. **(CVE-2026-56698) Client-side script execution via `navigateTo({ open: ... })`.** The\n   client-side early-open handler called `window.open(toPath, ...)` without\n   applying the `isScriptProtocol` check that gates the normal `navigateTo`\n   path. A target of `javascript:...` (or another script-capable scheme)\n   passed to `navig","public_affected_ranges":[">= 4.0.0, < 4.4.7"]},{"certainty":"source_listed","source_ids":["sr-339e847172514231b31c48f236be9cb2"],"technology":"nuxt","known_exclusions":[],"conditions_summary":"### Summary\n\nThree weaknesses in Nuxt's client-navigation URL handling, all reachable\nfrom documented public APIs (`navigateTo` and `reloadNuxtApp`):\n\n1. **(CVE-2026-56326) SSR open redirect in `navigateTo` via path-normalisation bypass.** \n   `navigateTo` decided whether a target was external by inspecting the raw\n   input with `hasProtocol(..., { acceptRelative: true })`. Inputs such as\n   `/..//evil.com`, `/.//evil.com`, `/%2e%2e//evil.com`, or\n   `/app/..//evil.com` slipped past that check because they start with\n   `/`, but WHATWG URL parsing then normalised them to the\n   protocol-relative pathname `//evil.com`. The normalised value was\n   written to the `Location` response header and into the\n   `` body of the SSR redirect page, so a\n   victim's browser would resolve the redirect cross-origin to the\n   attacker's host.\n\n2. **(CVE-2026-56698) Client-side script execution via `navigateTo({ open: ... })`.** The\n   client-side early-open handler called `window.open(toPath, ...)` without\n   applying the `isScriptProtocol` check that gates the normal `navigateTo`\n   path. A target of `javascript:...` (or another script-capable scheme)\n   passed to `navig","public_affected_ranges":[">= 3.5.0, < 3.21.7"]}],"null_published_at":"2026-11-08T19:53:44.063Z","source_updated_at":"2026-09-18T20:43:02.000Z","source_disclosed_at":"2026-06-16T13:47:52.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T14:29:31.527Z"},{"id":"NVI-00014025","kind":"vulnerability","title":"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c9cv-mq2m-ppp3","CVE-2026-56326"],"plain_summary":"GitHub lists this reviewed advisory for nuxt, nuxt. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0f8da134b68a17fed83b7d1392e34ec7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-18T20:43:02.000Z","value":"6.1 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-339e847172514231b31c48f236be9cb2"},{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.362%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.30133. Missing scores are unknown.","source_id":"sr-0f8da134b68a17fed83b7d1392e34ec7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-339e847172514231b31c48f236be9cb2","url":"https://github.com/advisories/GHSA-c9cv-mq2m-ppp3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c9cv-mq2m-ppp3","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:31.527Z"},{"id":"sr-0f8da134b68a17fed83b7d1392e34ec7","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-56326","publisher":"FIRST EPSS","observed_at":"2026-11-04T23:33:33.051Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-339e847172514231b31c48f236be9cb2"],"technology":"nuxt","known_exclusions":[],"conditions_summary":"### Summary\n\nThree weaknesses in Nuxt's client-navigation URL handling, all reachable\nfrom documented public APIs (`navigateTo` and `reloadNuxtApp`):\n\n1. **(CVE-2026-56326) SSR open redirect in `navigateTo` via path-normalisation bypass.** \n   `navigateTo` decided whether a target was external by inspecting the raw\n   input with `hasProtocol(..., { acceptRelative: true })`. Inputs such as\n   `/..//evil.com`, `/.//evil.com`, `/%2e%2e//evil.com`, or\n   `/app/..//evil.com` slipped past that check because they start with\n   `/`, but WHATWG URL parsing then normalised them to the\n   protocol-relative pathname `//evil.com`. The normalised value was\n   written to the `Location` response header and into the\n   `` body of the SSR redirect page, so a\n   victim's browser would resolve the redirect cross-origin to the\n   attacker's host.\n\n2. **(CVE-2026-56698) Client-side script execution via `navigateTo({ open: ... })`.** The\n   client-side early-open handler called `window.open(toPath, ...)` without\n   applying the `isScriptProtocol` check that gates the normal `navigateTo`\n   path. A target of `javascript:...` (or another script-capable scheme)\n   passed to `navig","public_affected_ranges":[">= 4.0.0, < 4.4.7"]},{"certainty":"source_listed","source_ids":["sr-339e847172514231b31c48f236be9cb2"],"technology":"nuxt","known_exclusions":[],"conditions_summary":"### Summary\n\nThree weaknesses in Nuxt's client-navigation URL handling, all reachable\nfrom documented public APIs (`navigateTo` and `reloadNuxtApp`):\n\n1. **(CVE-2026-56326) SSR open redirect in `navigateTo` via path-normalisation bypass.** \n   `navigateTo` decided whether a target was external by inspecting the raw\n   input with `hasProtocol(..., { acceptRelative: true })`. Inputs such as\n   `/..//evil.com`, `/.//evil.com`, `/%2e%2e//evil.com`, or\n   `/app/..//evil.com` slipped past that check because they start with\n   `/`, but WHATWG URL parsing then normalised them to the\n   protocol-relative pathname `//evil.com`. The normalised value was\n   written to the `Location` response header and into the\n   `` body of the SSR redirect page, so a\n   victim's browser would resolve the redirect cross-origin to the\n   attacker's host.\n\n2. **(CVE-2026-56698) Client-side script execution via `navigateTo({ open: ... })`.** The\n   client-side early-open handler called `window.open(toPath, ...)` without\n   applying the `isScriptProtocol` check that gates the normal `navigateTo`\n   path. A target of `javascript:...` (or another script-capable scheme)\n   passed to `navig","public_affected_ranges":[">= 3.5.0, < 3.21.7"]}],"null_published_at":"2026-11-07T14:02:01.393Z","source_updated_at":"2026-09-18T20:43:02.000Z","source_disclosed_at":"2026-06-16T13:47:52.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T14:29:31.527Z"},{"id":"NVI-00014025","kind":"vulnerability","title":"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c9cv-mq2m-ppp3","CVE-2026-56326"],"plain_summary":"GitHub lists this reviewed advisory for nuxt, nuxt. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-339e847172514231b31c48f236be9cb2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-18T20:43:02.000Z","value":"6.1 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-339e847172514231b31c48f236be9cb2"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-339e847172514231b31c48f236be9cb2","url":"https://github.com/advisories/GHSA-c9cv-mq2m-ppp3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c9cv-mq2m-ppp3","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:31.527Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-339e847172514231b31c48f236be9cb2"],"technology":"nuxt","known_exclusions":[],"conditions_summary":"### Summary\n\nThree weaknesses in Nuxt's client-navigation URL handling, all reachable\nfrom documented public APIs (`navigateTo` and `reloadNuxtApp`):\n\n1. **(CVE-2026-56326) SSR open redirect in `navigateTo` via path-normalisation bypass.** \n   `navigateTo` decided whether a target was external by inspecting the raw\n   input with `hasProtocol(..., { acceptRelative: true })`. Inputs such as\n   `/..//evil.com`, `/.//evil.com`, `/%2e%2e//evil.com`, or\n   `/app/..//evil.com` slipped past that check because they start with\n   `/`, but WHATWG URL parsing then normalised them to the\n   protocol-relative pathname `//evil.com`. The normalised value was\n   written to the `Location` response header and into the\n   `` body of the SSR redirect page, so a\n   victim's browser would resolve the redirect cross-origin to the\n   attacker's host.\n\n2. **(CVE-2026-56698) Client-side script execution via `navigateTo({ open: ... })`.** The\n   client-side early-open handler called `window.open(toPath, ...)` without\n   applying the `isScriptProtocol` check that gates the normal `navigateTo`\n   path. A target of `javascript:...` (or another script-capable scheme)\n   passed to `navig","public_affected_ranges":[">= 4.0.0, < 4.4.7"]},{"certainty":"source_listed","source_ids":["sr-339e847172514231b31c48f236be9cb2"],"technology":"nuxt","known_exclusions":[],"conditions_summary":"### Summary\n\nThree weaknesses in Nuxt's client-navigation URL handling, all reachable\nfrom documented public APIs (`navigateTo` and `reloadNuxtApp`):\n\n1. **(CVE-2026-56326) SSR open redirect in `navigateTo` via path-normalisation bypass.** \n   `navigateTo` decided whether a target was external by inspecting the raw\n   input with `hasProtocol(..., { acceptRelative: true })`. Inputs such as\n   `/..//evil.com`, `/.//evil.com`, `/%2e%2e//evil.com`, or\n   `/app/..//evil.com` slipped past that check because they start with\n   `/`, but WHATWG URL parsing then normalised them to the\n   protocol-relative pathname `//evil.com`. The normalised value was\n   written to the `Location` response header and into the\n   `` body of the SSR redirect page, so a\n   victim's browser would resolve the redirect cross-origin to the\n   attacker's host.\n\n2. **(CVE-2026-56698) Client-side script execution via `navigateTo({ open: ... })`.** The\n   client-side early-open handler called `window.open(toPath, ...)` without\n   applying the `isScriptProtocol` check that gates the normal `navigateTo`\n   path. A target of `javascript:...` (or another script-capable scheme)\n   passed to `navig","public_affected_ranges":[">= 3.5.0, < 3.21.7"]}],"null_published_at":"2026-11-02T10:00:37.198Z","source_updated_at":"2026-09-18T20:43:02.000Z","source_disclosed_at":"2026-06-16T13:47:52.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T14:29:31.527Z"}],"next_cursor":null,"snapshot_revision":"42594"}