Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

影響: npm:nuxt < 4.6.0 → 4.6.0

An application that renders with a value it does not control can be made to render an anchor whose href executes script in the application's origin when clicked. This is an incomplete fix for [GHSA-934w-87qh-qr26](https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26) (CVE-2026-53722). It only affects applications running without a pages/ directory, where pages resolves to false and Nuxt registers its own router in place of vue-router. Applications using vue-router are not affect…

在 GitHub Advisory Database 阅读

2026/10/23 01:51，GitHub Advisory Database 发布了“Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js、Nuxt、Vue.js、GitHub。CVE：CVE-2026-114130。