CVE-2026-71320: 
Nuxt Analyse et atténuation des vulnérabilités

CVE-2026-71320 is a server-side remote code execution (RCE) vulnerability in the Nuxt web framework caused by runtime template injection via Nuxt Server Island props. An unauthenticated attacker can inject a malicious template key through the /__nuxt_island/ endpoint into a dynamic component when vue.runtimeCompiler: true is enabled, causing arbitrary template execution in the Nitro server process. The vulnerability affects Nuxt versions >= 3.4.0 < 3.21.10 and >= 4.0.0 < 4.5.1; Nuxt 2 and earlier v3 releases are not affected. It was published on August 5, 2026, with a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Feedly).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74) combined with improper control of code generation (CWE-94). Nuxt server islands accept props via the /__nuxt_island/ endpoint as JSON; when vue.runtimeCompiler: true is configured, a template key anywhere in the parsed props object is passed into Vue's dynamic component resolution (<component :is>, resolveDynamicComponent, or h()), causing Vue's runtime compiler to compile and execute the attacker-controlled template string in the Nitro server process. Exploitation is further enabled by Vue's attribute inheritance: if a server island's single root element is a polymorphic component (e.g., from @nuxt/ui via reka-ui) that exposes an as/asChild prop, the attacker's injected value falls through implicitly without any explicit prop forwarding by the island author. The island URL hash is a deterministic, unsalted content hash and does not serve as an authentication boundary, meaning an attacker who knows the component name can compute a valid hash (GitHub Advisory, Patch Commit v4).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code within the Nitro server process with the same privileges as the server, resulting in high confidentiality, integrity, and availability impact. An attacker could exfiltrate sensitive server-side data, modify application behavior, or achieve full server compromise, potentially enabling lateral movement within the hosting environment. Static site generation (SSG) deployments are largely unaffected since there is no live server process to exploit (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Nuxt applications running versions >= 3.4.0 < 3.21.10 or >= 4.0.0 < 4.5.1 that expose the /__nuxt_island/ endpoint publicly. Confirm that vue.runtimeCompiler: true is enabled (e.g., by observing client-side behavior or error messages).
2. Identify a vulnerable server island: Locate a .server.vue component whose root element is a polymorphic component (e.g., a @nuxt/ui / reka-ui component with an as/asChild prop), or one that explicitly forwards props into <component :is>, resolveDynamicComponent, or h().
3. Compute the island request hash: Using the known component name and desired props, compute the deterministic (unsalted) content hash required by the /__nuxt_island/ endpoint.
4. Craft the malicious request: Send an HTTP request to /__nuxt_island/<ComponentName>_<hash>.json with a JSON props payload containing a template key at any depth, e.g., { "as": { "template": "<malicious-vue-template>" } }.
5. Achieve server-side RCE: Vue's runtime compiler compiles and executes the attacker-controlled template string in the Nitro process, enabling arbitrary command execution, data exfiltration, or further lateral movement with server process privileges (GitHub Advisory, Patch Commit v4).

• Network: Unusual or unexpected HTTP requests to /__nuxt_island/ endpoints containing JSON props with a template key at any nesting depth; requests with URL-encoded or JSON-encoded payloads containing "template" in the props query parameter or request body.
• Logs: Server access logs showing HTTP 400 responses with the message Invalid island request props (indicating the patched server is blocking attempts); in unpatched servers, unexpected template compilation errors or stack traces in Nitro/Node.js process logs originating from Vue's runtime compiler.
• Process: Unexpected child processes spawned by the Nitro/Node.js server process (e.g., sh, bash, curl, wget, python) that are not part of normal application operation.
• File System: Unexpected new files, scripts, or web shells written to the application directory or temp directories by the server process (GitHub Advisory, Patch Commit v4).

Upgrade to nuxt@3.21.10 (for v3 users) or nuxt@4.5.1 (for v4 users) using npx nuxt upgrade --dedupe, which rejects island requests whose decoded props contain a template key at any depth with an HTTP 400 when vue.runtimeCompiler is enabled (v3.21.10 Release, v4.5.1 Release). If immediate upgrade is not possible, set vue.runtimeCompiler: false (the default) in your Nuxt config, which eliminates the attack vector entirely. As additional mitigations: avoid forwarding island props directly into <component :is>, resolveDynamicComponent, or h() without sanitization; and consider deploying a WAF rule on /__nuxt_island/ that blocks any JSON object property named template in decoded island props — noting that this does not cover initial SSR internal island renders (GitHub Advisory).

The advisory was published by Nuxt maintainer danielroe and described as a security release, with both v3.21.10 and v4.5.1 release notes explicitly recommending immediate upgrade. The release notes also note that this patch is part of a broader security release addressing multiple issues including route rule authorization bypass and server component DoS, and that @nuxt/devtools@3.3.1 (pulled in via lockfile refresh) separately fixes a critical development-only RCE. Documentation updates were added to warn about runtimeCompiler security best practices and the importance of validating server component props (v4.5.1 Release, v3.21.10 Release).