Summary
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
Common configurations that satisfy the preconditions
The flaw is in Nuxt core. The library below is not itself vulnerable; it is noted because it commonly provides the dynamic-component sink an application might inadvertently expose.
@nuxt/ui(via its underlyingreka-uiprimitives) exposes a polymorphicas/asChildprop that is forwarded into Vue's dynamic-component resolution. Installing@nuxt/uidoes not by itself register any component as a server island. Exploitation requires the application to define an island component (a.server.vuefile) whose rendered output puts the attacker-controlled value on such a component'sas/asChildprop; withvue.runtimeCompiler: true, the attacker-controlledtemplateis then compiled and executed. Because undeclared island props fall through as attributes to the single root, this can happen without any explicit binding: an island whose root is areka-ui/@nuxt/uicomponent is enough. An example vulnerable island (theasvalue falls through toUButton, no explicit forwarding needed):<!-- components/MyWidget.server.vue --> <template> <UButton>Save</UButton> </template>
The island URL hash (/__nuxt_island/<Name>_<hash>.json) is a deterministic (unsalted) content hash, not an authentication token. It provides integrity relative to the URL but is not a security boundary: an attacker who knows the component name and desired props can compute a valid hash.
Mitigating factors
vue.runtimeCompileris off by default in Nuxt. The vast majority of Nuxt applications are not affected.- Exploitation requires a second precondition: the application must have a server island component that puts an attacker-controlled value onto a dynamic-component path (
<component :is>,resolveDynamicComponent,h(), or a polymorphicas/asChildprop). This can occur explicitly or via attribute fallthrough when the island's root is such a component. - SSG / static deployments are largely unreachable via this vector (no server process to exploit).
- Island component names are constrained to the build-time component registry; an attacker cannot resolve arbitrary components.
Affected versions
Nuxt >=3.4.0 <3.21.10 and >=4.0.0 <4.5.1, and only when vue.runtimeCompiler: true and component islands are active. Earlier versions did not allow the Vue compiler to be enabled in the server bundle (the compiler dependencies have been mock-aliased on the server since v3.0.0-rc.1), so the runtime-compilation path is not reachable. Nuxt 2 is not affected (no server islands).
Workarounds
Upgrade to [email protected] or [email protected]. If you cannot immediately upgrade, you can mitigate by:
- Ensure
vue.runtimeCompileris set tofalse(the default). - Do not forward island props into
<component :is>,resolveDynamicComponent, orh()without sanitization. - As a defense-in-depth measure, deploy a WAF rule on
/__nuxt_island/that URL-decodes and JSON-parses thepropsvalue and blocks any object property namedtemplateorrenderin the decoded island props, inspecting both query and body for all methods. Note: this only covers direct and browser-originated island requests; initial-SSR internal island renders do not transit the edge and a WAF alone does not close the vector.
Impact
Nuxt server islands accept props via the /__nuxt_island/ endpoint. When vue.runtimeCompiler: true is enabled (off by default) and the application has a server island component that forwards props into Vue's dynamic component resolution (<component :is>, resolveDynamicComponent, or h()), an attacker can inject a template key into the island props to achieve server-side remote code execution in the Nitro process.
{ "as": { "template": "<attacker-controlled>" } }
Vue's runtime template compiler compiles and executes the attacker-controlled template in the server process. The same primitive also works on the client side when the runtime compiler is active there, though the server-side path is the primary concern.
Some component libraries expose a polymorphic as / asChild prop that forwards its value into <component :is>; @nuxt/ui (via reka-ui) is a widely used example. An application is affected if such a component receives the attacker-controlled value, provided vue.runtimeCompiler is also enabled. Note this does not require the island author to explicitly forward a prop: island props that the island component does not declare fall through as attributes onto its single root element (standard Vue attribute inheritance), so an island whose root is a polymorphic component receives the attacker's as value implicitly. These libraries are not themselves vulnerable; they are noted only because they commonly provide the dynamic-component sink.
Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.
CVE-2026-71320 has a CVSS score of 8.1 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.5.1, 3.21.10); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
When vue.runtimeCompiler is enabled, island requests whose decoded props contain a template key at any depth are rejected with an HTTP 400 and a diagnostic suggesting the author rename the prop or disable the runtime compiler. The guard is gated on the runtime compiler being enabled, so the default configuration (compiler off) is unaffected and legitimate props that merely contain a template field (for example CMS content) continue to render. A render key is not rejected: island props arrive as JSON, so a render value can only be an inert string, which Vue ignores.
Fixed in [email protected] and backported to [email protected].
Frequently Asked Questions
- What is CVE-2026-71320? CVE-2026-71320 is a high-severity code injection vulnerability in nuxt (npm), affecting versions >= 4.0.0, < 4.5.1. It is fixed in 4.5.1, 3.21.10. Untrusted input is evaluated as executable code within the application's runtime environment.
- How severe is CVE-2026-71320? CVE-2026-71320 has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of nuxt are affected by CVE-2026-71320? nuxt (npm) versions >= 4.0.0, < 4.5.1 is affected.
- Is there a fix for CVE-2026-71320? Yes. CVE-2026-71320 is fixed in 4.5.1, 3.21.10. Upgrade to this version or later.
- Is CVE-2026-71320 exploitable, and should I be worried? Whether CVE-2026-71320 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-71320 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-71320?
- Upgrade
nuxtto 4.5.1 or later - Upgrade
nuxtto 3.21.10 or later
- Upgrade