AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-71320

HIGH · CVSS 8.1 EPSS 0.44% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-05 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The vulnerability allows attackers to inject a template key into dynamic components via the /__nuxt_island/ props when the `vue.runtimeCompiler` option is enabled, potentially leading to arbitrary template execution within the Nitro process. This poses a significant risk to applications using Nuxt versions 3.4.0 to 3.21.10 and 4.5.1. Organizations utilizing these versions should prioritize patching to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-71320
Severity
HIGH
CVSS
8.1
EPSS
0.44%

Original NVD Description

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.