{"data":{"id":"aa723f5f-f4f9-4b80-8b13-8744de4e497f","title":"GHSA-c9cv-mq2m-ppp3: Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`","summary":"GHSA-c9cv-mq2m-ppp3 describes three URL-handling weaknesses in Nuxt's `navigateTo` and `reloadNuxtApp` APIs. A path-normalisation bypass lets inputs such as `/..//evil.com` become protocol-relative redirects in SSR responses, and `navigateTo({ open })` and `reloadNuxtApp({ path })` can run script URLs or redirect cross-origin.","solution":"Fixed in `nuxt@4.4.7` and backported to `nuxt@3.21.7`, with separate commits for each of the three sinks. Workarounds for the first sink: validate redirect targets before `navigateTo`, for example by rejecting input where `new URL(target, 'http://localhost').pathname` starts with `//`, or by accepting only an allow-list of paths. For the second sink, reject user-controlled URLs whose protocol is not in an allow-list, typically just `http:` and `https:`.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-c9cv-mq2m-ppp3","publishedAt":"2026-06-16T13:47:52.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["nuxt@< 3.21.7 (fixed: 3.21.7)","nuxt@>= 4.0.0, < 4.4.7 (fixed: 4.4.7)"],"affectedPackageNames":["nuxt"],"affectedPackageRefs":["npm:nuxt"],"affectedVendors":[],"affectedVendorsRaw":["Nuxt"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-c9cv-mq2m-ppp3"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-16T13:47:52.000Z","fixReleasedAt":"2026-06-02T14:23:02.095Z","daysToFix":-14,"fixCheckedAt":"2026-10-29T21:34:38.065Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.3,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"nuxt","fixedVersion":"4.4.7","matchedVersion":"4.4.7","fixReleasedAt":"2026-06-02T14:25:32.196Z","daysToFix":-14,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:37.919Z"},{"ecosystem":"npm","name":"nuxt","fixedVersion":"3.21.7","matchedVersion":"3.21.7","fixReleasedAt":"2026-06-02T14:23:02.095Z","daysToFix":-14,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:37.919Z"}]}}