Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2026-71318.md

Created August 6, 2026 03:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/3d7b500e615305ceff4644e15070fc7a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/3d7b500e615305ceff4644e15070fc7a to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-71318: CVE-2026-71318: Unauthorized Component Instantiation via Nuxt Server Island Props - CVE Security Report
Raw
CVE-2026-71318.md

CVE-2026-71318: CVE-2026-71318: Unauthorized Component Instantiation via Nuxt Server Island Props

CVSS Score: 4.8 Published: 2026-08-05 Full Report: https://cvereports.com/reports/CVE-2026-71318

Summary

CVE-2026-71318 is a vulnerability in Nuxt where unauthenticated remote attackers can trigger unauthorized component instantiation and arbitrary HTML element injection. This security flaw is caused by default attribute inheritance (fallthrough) combined with polymorphic root components inside island components accessible via the /__nuxt_island/ endpoint. Attackers can bypass standard routing checks to instantiate globally registered components or inject raw HTML tags like iframes. This vector is highly reachable since it does not require enabling the vue.runtimeCompiler option. It is patched in Nuxt versions 3.21.10 and 4.5.1.

TL;DR

Unauthenticated remote attackers can inject arbitrary HTML elements or instantiate globally-registered Vue components via the /__nuxt_island/ endpoint by exploiting attribute fallthrough on polymorphic root elements.

Exploit Status: POC

Technical Details

  • CWE ID: CWE-20
  • Attack Vector: Network
  • CVSS v3.1: 4.8 (Medium)
  • EPSS Score: N/A
  • Impact: HTML Injection / Component Hijacking
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • Nuxt applications utilizing Server Islands with polymorphic root components
  • nuxt: >= 3.1.0, < 3.21.10 (Fixed in: 3.21.10)
  • nuxt: >= 4.0.0, < 4.5.1 (Fixed in: 4.5.1)

Mitigation

  • Upgrade Nuxt to fixed versions (3.21.10+ / 4.5.1+)
  • Disable attribute inheritance (inheritAttrs: false) in server-side components
  • Enforce strict allowlists for dynamic components instead of raw client strings
  • Avoid globally registering sensitive UI components

Remediation Steps:

  1. Identify all server-side island components in the project matching *.server.vue.
  2. Inspect the package.json and update nuxt to either 3.21.10 or 4.5.1 depending on your version track.
  3. Examine island templates for polymorphic components or elements bound via v-bind.
  4. Implement inheritAttrs: false within island components to prevent implicit attribute fallthrough.
  5. Verify that dynamic component bindings () resolve exclusively against a predefined list of allowed tags.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment