{"schema":"threatline.record/2","record":{"id":"CVE-2026-114133","aliases":["GHSA-xfq5-w38q-pc2x"],"summary":"Nuxt server islands render `useHeadSafe` input without sanitisation","details":"## Impact\n\n`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `<script>` tags are only kept for JSON types.\n\nWhen `useHeadSafe` is called inside a server island (a `.server.vue` component or page, or a component rendered with `<NuxtIsland>`), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. `<NuxtIsland>` then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.\n\nAs a result, input that `useHeadSafe` would normally strip (such as `bodyAttrs.onload` or executable `<script>` content) is rendered into the page. If an application passes user-controlled data to `useHeadSafe` inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.\n\n```vue\n<!-- components/AuthorMeta.server.vue -->\n<script setup lang=\"ts\">\nconst { data: author } = await useFetch('/api/author')\n// author.value.head is user-authored, e.g. { bodyAttrs: { onload: '...' } }\nuseHeadSafe(author.value.head)\n</script>\n```\n\n## Mitigating factors\n\n- Server components are experimental. They are only active when the application defines a `.server.vue` component or page, or enables `experimental.componentIslands` and renders `<NuxtIsland>`.\n- Exploitation requires the application to pass attacker-controlled data to `useHeadSafe` inside a server island. `useHeadSafe` called from regular (non-island) components and pages is not affected.\n\n## Affected versions\n\n`nuxt` `>=3.13.0`, when head support for server islands was introduced. Nuxt 2 is not affected.\n\n## Patches\n\nFixed in `nuxt@4.6.2`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.\n\nPatched releases apply Unhead's safe input filtering to `useHeadSafe` entries on the server before they are added to the island response, so `islandResponse.head` (including what `render:island` hooks see) only contains input that `useHeadSafe` allows.\n\n## Workarounds\n\nUpgrade to `nuxt@4.6.2`. If you cannot upgrade, including on Nuxt 3:\n\n1. Call `useHeadSafe` with untrusted input from a regular component or page rather than from inside a server island.\n2. Alternatively, validate untrusted head input against your own allowlist before passing it to `useHeadSafe` inside a server island.","categories":["Frameworks"],"product":"nuxt","vendor":"nuxt","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","source_modified_at":"2026-10-22T16:58:02Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"nuxt"},"range":">= 3.13.0, < 4.6.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114133","source_modified_at":"2026-10-21T17:53:26.503Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"nuxt","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.13.0, < 4.6.2"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xfq5-w38q-pc2x","source_modified_at":"2026-10-22T17:15:04.291934160Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"nuxt","ecosystem":"npm","purl":"pkg:npm/nuxt"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.13.0"},{"fixed":"4.6.2"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","source_modified_at":"2026-10-22T16:58:02Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"nuxt"},"version":"4.6.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xfq5-w38q-pc2x","source_modified_at":"2026-10-22T17:15:04.291934160Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"nuxt","ecosystem":"npm","purl":"pkg:npm/nuxt"},"version":"4.6.2"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00176,"percentile":0.06727,"score_date":"2026-10-23"},"published_at":"2026-10-21T17:52:09.381Z","modified_at":"2026-10-22T17:15:04.291934160Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T16:58:02Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-114133","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-21T17:53:26.503Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-xfq5-w38q-pc2x","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-22T17:15:04.291934160Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114133","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114133","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.2","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-22T17:15:04.291934160Z","content_hash":"340734edbcf89932f1da2aaaf9ab87bd80d70b49b77922c0cc92f5626c0e099c"}}