The nuxt-modules og-image component generates Open Graph images using Vue templates in Nuxt. Versions before 6.2.5 expose an XSS vulnerability through the URI /_og/d/ (and /og-image/ in older versions) that permits injection of arbitrary HTML attributes into the page body. This improper neutralization of input during web page generation (CWE-79) can lead to limited confidentiality and integrity impacts. The vulnerability is addressed by an official patch in version 6.2.5.

Exploitation of this vulnerability could allow an attacker to inject arbitrary attributes into the HTML body of the generated Open Graph image page, potentially leading to cross-site scripting attacks. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact. There are no known exploits in the wild at this time.

Upgrade the nuxt-modules og-image component to version 6.2.5 or later, where the vulnerability has been patched. Since this is not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor advisory stating the fix is included in version 6.2.5.