Search: CVE-2026-53722

Nuxt versions prior to 4.4.7 and 3.21.7 contain a reflected DOM-based cross-site scripting (XSS) vulnerability in the <NuxtLink> component. This occurs because the component does not validate URL schemes in its 'to' or 'href' props, allowing attacker-controlled inputs with 'javascript:', 'vbscript:', or 'data:' URLs to be rendered directly into anchor href attributes. Clicking such links can execute malicious scripts in the application's origin or enable phishing attacks. The issue affects applications that bind user input to <NuxtLink> URLs, such as user profiles, CMS fields, or marketplace listings. The vulnerability is fixed in nuxt@4.4.7 and nuxt@3.21.7 by sanitizing and rejecting script-capable URL schemes before rendering.