{"id":"ghsa-ghsa-jjm6-p2m9-9w4x","seq":309551,"kind":"advisory","title":"Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled","url":"https://github.com/advisories/GHSA-jjm6-p2m9-9w4x","permalink":"https://vulnpulse.app/items/ghsa-ghsa-jjm6-p2m9-9w4x","summary":"影響: npm:nuxt < 4.6.0 → 4.6.0\nAn application that renders with a value it does not control can be made to render an anchor whose href executes script in the application's origin when clicked. This is an incomplete fix for [GHSA-934w-87qh-qr26](https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26) (CVE-2026-53722). It only affects applications running without a pages/ directory, where pages resolves to false and Nuxt registers its own router in place of vue-router. Applications using vue-router are not affect…","severity":"low","techs":["nodejs","nuxt","vue","github"],"cves":["CVE-2026-114130"],"tags":["GHSA-jjm6-p2m9-9w4x","nuxt"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:51:37.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}