{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.4.0"
            },
            {
              "fixed": "3.21.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71320"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T21:29:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Impact\n\nNuxt server islands accept props via the `/__nuxt_island/` endpoint. When `vue.runtimeCompiler: true` is enabled (off by default) and the application has a server island component that forwards props into Vue\u0027s dynamic component resolution (`\u003ccomponent :is\u003e`, `resolveDynamicComponent`, or `h()`), an attacker can inject a `template` key into the island props to achieve server-side remote code execution in the Nitro process.\n\n```json\n{ \"as\": { \"template\": \"\u003cattacker-controlled\u003e\" } }\n```\n\nVue\u0027s runtime template compiler compiles and executes the attacker-controlled `template` in the server process. The same primitive also works on the client side when the runtime compiler is active there, though the server-side path is the primary concern.\n\nSome component libraries expose a polymorphic `as` / `asChild` prop that forwards its value into `\u003ccomponent :is\u003e`; `@nuxt/ui` (via `reka-ui`) is a widely used example. An application is affected if such a component receives the attacker-controlled value, provided `vue.runtimeCompiler` is also enabled. Note this does not require the island author to explicitly forward a prop: island props that the island component does not declare fall through as attributes onto its single root element (standard Vue attribute inheritance), so an island whose root is a polymorphic component receives the attacker\u0027s `as` value implicitly. These libraries are not themselves vulnerable; they are noted only because they commonly provide the dynamic-component sink.\n\n## Common configurations that satisfy the preconditions\n\nThe flaw is in Nuxt core. The library below is not itself vulnerable; it is noted because it commonly provides the dynamic-component sink an application might inadvertently expose.\n\n- **`@nuxt/ui`** (via its underlying **`reka-ui`** primitives) exposes a polymorphic `as` / `asChild` prop that is forwarded into Vue\u0027s dynamic-component resolution. Installing `@nuxt/ui` does not by itself register any component as a server island. Exploitation requires the application to define an island component (a `.server.vue` file) whose rendered output puts the attacker-controlled value on such a component\u0027s `as` / `asChild` prop; with `vue.runtimeCompiler: true`, the attacker-controlled `template` is then compiled and executed. Because undeclared island props fall through as attributes to the single root, this can happen without any explicit binding: an island whose root is a `reka-ui` / `@nuxt/ui` component is enough. An example vulnerable island (the `as` value falls through to `UButton`, no explicit forwarding needed):\n\n  ```vue\n  \u003c!-- components/MyWidget.server.vue --\u003e\n  \u003ctemplate\u003e\n    \u003cUButton\u003eSave\u003c/UButton\u003e\n  \u003c/template\u003e\n  ```\n\nThe island URL hash (`/__nuxt_island/\u003cName\u003e_\u003chash\u003e.json`) is a deterministic (unsalted) content hash, not an authentication token. It provides integrity relative to the URL but is not a security boundary: an attacker who knows the component name and desired props can compute a valid hash.\n\n## Mitigating factors\n\n- `vue.runtimeCompiler` is **off by default** in Nuxt. The vast majority of Nuxt applications are not affected.\n- Exploitation requires a **second precondition**: the application must have a server island component that puts an attacker-controlled value onto a dynamic-component path (`\u003ccomponent :is\u003e`, `resolveDynamicComponent`, `h()`, or a polymorphic `as` / `asChild` prop). This can occur explicitly or via attribute fallthrough when the island\u0027s root is such a component.\n- SSG / static deployments are largely unreachable via this vector (no server process to exploit).\n- Island component names are constrained to the build-time component registry; an attacker cannot resolve arbitrary components.\n\n## Affected versions\n\nNuxt `\u003e=3.4.0 \u003c3.21.10` and `\u003e=4.0.0 \u003c4.5.1`, and only when `vue.runtimeCompiler: true` and component islands are active. Earlier versions did not allow the Vue compiler to be enabled in the server bundle (the compiler dependencies have been mock-aliased on the server since v3.0.0-rc.1), so the runtime-compilation path is not reachable. Nuxt 2 is not affected (no server islands).\n\n## Patches\n\nWhen `vue.runtimeCompiler` is enabled, island requests whose decoded props contain a `template` key at any depth are rejected with an HTTP 400 and a diagnostic suggesting the author rename the prop or disable the runtime compiler. The guard is gated on the runtime compiler being enabled, so the default configuration (compiler off) is unaffected and legitimate props that merely contain a `template` field (for example CMS content) continue to render. A `render` key is not rejected: island props arrive as JSON, so a `render` value can only be an inert string, which Vue ignores.\n\nFixed in `nuxt@4.5.1` and backported to `nuxt@3.21.10`.\n\n## Workarounds\n\nUpgrade to `nuxt@4.5.1` or `nuxt@3.21.10`. If you cannot immediately upgrade, you can mitigate by:\n\n1. Ensure `vue.runtimeCompiler` is set to `false` (the default).\n2. Do not forward island props into `\u003ccomponent :is\u003e`, `resolveDynamicComponent`, or `h()` without sanitization.\n3. As a defense-in-depth measure, deploy a WAF rule on `/__nuxt_island/` that URL-decodes and JSON-parses the `props` value and blocks any object property named `template` or `render` in the decoded island props, inspecting both query and body for all methods. Note: this only covers direct and browser-originated island requests; initial-SSR internal island renders do not transit the edge and a WAF alone does not close the vector.",
  "id": "GHSA-9473-5f9j-94wq",
  "modified": "2026-08-05T21:29:55Z",
  "published": "2026-08-05T21:29:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nuxt/nuxt"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/releases/tag/v3.21.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/releases/tag/v4.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props"
}