Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2026-71320.md

Created August 6, 2026 01:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/71f7a1bcf3053bbd51b0ae56e484d06e to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/71f7a1bcf3053bbd51b0ae56e484d06e to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-71320: CVE-2026-71320: Remote Code Execution in Nuxt via Server-Side Template Injection in Server Islands - CVE Security Report
Raw
CVE-2026-71320.md

CVE-2026-71320: CVE-2026-71320: Remote Code Execution in Nuxt via Server-Side Template Injection in Server Islands

CVSS Score: 8.1 Published: 2026-08-05 Full Report: https://cvereports.com/reports/CVE-2026-71320

Summary

A highly critical Server-Side Remote Code Execution (RCE) vulnerability exists in the Nuxt framework when Server Islands and the Vue runtime compiler are simultaneously enabled. This allows unauthenticated remote attackers to execute arbitrary system commands on the host process by passing a crafted component definition object to the dynamic component resolution engine via public island endpoints.

TL;DR

Unauthenticated Remote Code Execution (RCE) in Nuxt via Server-Side Template Injection (SSTI) when the Vue runtime compiler is enabled, triggered through crafted props sent to Server Island endpoints.

Exploit Status: POC

Technical Details

  • CWE ID: CWE-94: Improper Control of Generation of Code ('Code Injection')
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.1 (High)
  • EPSS Score: Not Registered / New CVE
  • Impact: Server-Side Remote Code Execution (RCE)
  • Exploit Status: Proof-of-Concept (PoC)
  • KEV Status: Not Listed

Affected Systems

  • Nuxt 3.x applications with server islands and runtime compiler active
  • Nuxt 4.x applications with server islands and runtime compiler active
  • Nuxt: >= 3.4.0, < 3.21.10 (Fixed in: 3.21.10)
  • Nuxt: >= 4.0.0, < 4.5.1 (Fixed in: 4.5.1)

Mitigation

  • Upgrade to Nuxt 3.21.10 or 4.5.1 to leverage built-in island prop filtering.
  • Set vue.runtimeCompiler to false in nuxt.config.ts to block server-side compiling.
  • Configure WAF rules to reject HTTP requests containing a nested template key targeted at /__nuxt_island/.

Remediation Steps:

  1. Analyze nuxt.config.ts for the presence of vue.runtimeCompiler: true.
  2. If the runtime compiler is not required, disable or remove the line.
  3. Run npm update nuxt or yarn upgrade nuxt to fetch versions >= 3.21.10 or >= 4.5.1.
  4. Deploy the updated application and verify that island requests containing a template prop return HTTP 400.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment