<NuxtLink> did not validate the URL scheme of values bound to its 'to' or 'href' props before rendering them into the href attribute of the underlying anchor element. This allowed attacker-controlled inputs containing 'javascript:', 'vbscript:', or 'data:text/html,...' URLs to be reflected verbatim, resulting in reflected DOM-based XSS or same-tab phishing surfaces. The vulnerability arises because the external link detection treated any URL with a protocol as external and rendered it without rejecting script-capable protocols, unlike the navigateTo function which had script protocol checks. The flaw affects any Nuxt application binding user-controlled values to <NuxtLink :to> or :href, including profile links, CMS-driven URLs, and marketplace listings. The issue was fixed in [email protected] and backported to [email protected] by sanitizing the href before rendering, stripping control characters and whitespace, unwrapping 'view-source:' prefixes, and replacing script-capable schemes with an empty string.

Applications using vulnerable Nuxt versions that bind user-controlled input to <NuxtLink :to> or :href are susceptible to reflected DOM-based XSS attacks. This can lead to session theft (for non-HttpOnly cookies), CSRF token theft, account takeover via DOM manipulation, and credential harvesting through fake login overlays. Additionally, 'data:text/html,...' payloads enable same-tab phishing attacks anchored to legitimate application links. The vulnerability compromises the security of the first-party origin and user trust.

A fix is available in [email protected] and [email protected]. Upgrade to these or later versions to remediate the vulnerability. The fix sanitizes external href values by stripping control characters and whitespace, unwrapping 'view-source:' prefixes, and replacing script-capable URL schemes with an empty string before rendering. Until upgrading, validate URLs at the source before binding them to <NuxtLink :to> or :href, for example by only accepting paths starting with '/' or by using URL parsing to allow only safe protocols such as 'http:' and 'https:'.