CyberRota Analysis
AI-GeneratedThe vulnerability allows attackers to manipulate the dynamic component resolution in Nuxt by supplying a top-level `as` prop to the /__nuxt_island/ endpoint, potentially leading to unauthorized access or execution of arbitrary components. This affects versions 3.1.0 through 3.21.10 and 4.5.1, and users of the Nuxt framework should prioritize updating to the patched versions to mitigate the risk. Developers leveraging Nuxt for web applications should take immediate action to ensure their deployments are secure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.