{"action":"Upgrade nuxt to 3.21.7 or later.","affected":[{"fixed":"4.4.7","introduced":"4.0.0"},{"fixed":"3.21.7","introduced":"0"}],"component":"nuxt","cve_ids":["CVE-2026-56317"],"ecosystem":"npm","epss":0.00342,"exploited":false,"fixed_versions":["4.4.7","3.21.7"],"ghsa_id":"GHSA-m3q2-p4fw-w38m","id":"tcs_01M5KFZG176YMF60EBHHPK2WFF","modified_at":"2026-09-10T00:00:07.977137430Z","published_at":"2026-06-16T23:38:47Z","references":["https://osv.dev/vulnerability/GHSA-m3q2-p4fw-w38m","https://github.com/nuxt/nuxt/security/advisories/GHSA-m3q2-p4fw-w38m","https://nvd.nist.gov/vuln/detail/CVE-2026-56317","https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e","https://github.com/nuxt/nuxt/commit/7fea9fd687f1dacbfb63db5fae5839896b017a0e","https://github.com/nuxt/nuxt","https://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-noscript-component-slot-content"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-m3q2-p4fw-w38m","url":"https://osv.dev/vulnerability/GHSA-m3q2-p4fw-w38m"}],"summary":"Cross-site scripting via <NoScript> slot content in Nuxt's head components"}