CVE-2026-34405Medium· 6.1▾ SunlitNuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary att…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in version 6.2.5.
og_image < 6.2.5Upgrade past the affected range:
og_image 6.2.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114130Low· 2.3Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
CVE-2026-114133Medium· 5.4Nuxt server islands render `useHeadSafe` input without sanitisation
CVE-2025-52662Medium· 6.9A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***
GHSA-xppm-jmw6-fhmfLowDuplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components
CVE-2026-56317LowCross-site scripting via <NoScript> slot content in Nuxt's head components
CVE-2026-34404High· 7.5Nuxt OG Image generates OG Images with Vue templates in Nuxt