Nuxt server islands render `useHeadSafe` input without sanitisation

影響: npm:nuxt >= 3.13.0, < 4.6.2 → 4.6.2

useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and Mitigating factors - Server components are experimental. They are only active when the application defines a .server.vue component or page, or enables experimental.componentIslands and renders . - Exploitation requires the application to pass attacker-controlled data to useHeadSafe inside a server island. useHeadSafe called…

GitHub Advisory Database에서 읽기

2026. 10. 23. 오전 01:58, GitHub Advisory Database에서 "Nuxt server islands render `useHeadSafe` input without sanitisation"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js, Nuxt, Vue.js. CVE: CVE-2026-114133.