6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34405

CVE-2026-34405: Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in version 6.2.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34405

CVE-2026-34405:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nuxt-og-image	npm	< 6.2.5	6.2.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a reflected Cross-Site Scripting (XSS) attack in the nuxt-og-image package, where query parameters are injected as HTML attributes. The analysis began by identifying the commits between the last vulnerable version (v6.2.4) and the first patched version (v6.2.5). The key commit 3dcf8c1566e30a83fedd1ab2706dc6e8429f513d introduces a fix by sanitizing component props.

The commit analysis reveals two main changes:

A new function, sanitizeProps, is added to src/runtime/shared.ts. This function is designed to strip potentially dangerous attributes and event handlers (like on*) from an object of properties.
The resolveContext function in src/runtime/server/og-image/context.ts is modified to use this new sanitizeProps function on the options.props object, which is derived from the request's query parameters.

Prior to this change, resolveContext would process the request and pass the raw, unsanitized query parameters as props to the Vue component responsible for rendering the OG image. This is the root cause of the vulnerability. During exploitation, the resolveContext function would be on the call stack as it's the entry point for handling the malicious request and its parameters. Therefore, resolveContext is identified as the vulnerable function.

Vulnerable functions

resolveContext

src/runtime/server/og-image/context.ts

The `resolveContext` function is responsible for processing the incoming request and preparing the options for rendering the OG image. This includes extracting properties from the URL's query parameters. Before the patch, this function passed these properties directly to the rendering component without any sanitization. This allowed an attacker to inject malicious HTML attributes (e.g., `onmouseover`) and execute arbitrary JavaScript, leading to a reflected Cross-Site Scripting (XSS) vulnerability. The patch mitigates this by adding a call to the new `sanitizeProps` function to clean the properties before they are used.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.