The GitHub Advisory Database said on 22 October that the Nuxt web framework has a flaw in its NuxtLink component. A crafted link can run script in the app's origin when clicked. The advisory calls it an incomplete fix for GHSA-934w-87qh-qr26 (CVE-2026-53722). An invisible control character, such as %01, placed before javascript: hides the protocol. Nuxt then treated the value as an internal route and skipped its check. Browsers drop the character and run the script.
The advisory says only apps without a pages/ directory, or with pages set to false, are affected. Apps using vue-router are not. The app must also bind untrusted input to the link's :to value. Affected are all Nuxt 3 releases and nuxt versions before 4.6.0. The advisory gives no severity rating. It does not say whether attackers have used the flaw.
The advisory says nuxt 4.6.0 fixes this, and it urges an upgrade. Nuxt 3 reached end of life on 31 July 2026 and gets no fix. Teams on Nuxt 3 must check link values themselves, for example by accepting only paths that start with a single slash.