Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nuxt | npm | >= 4.0.0, < 4.5.1 | 4.5.1 |
| nuxt | npm | >= 3.4.0, < 3.21.10 | 3.21.10 |
Miggo AIRoot Cause AnalysisThe vulnerability is a server-side remote code execution in Nuxt, caused by a runtime template injection vulnerability in the handling of server island props. The root cause is the lack of input validation on the props sent to the /__nuxt_island/ endpoint. When an application has vue.runtimeCompiler: true enabled, an attacker can send a JSON payload with a template key containing malicious code. The getIslandContext function in packages/nitro-server/src/runtime/handlers/island.ts is the primary function responsible for processing these island requests. In vulnerable versions, this function would accept the props without checking for dangerous keys like template. The props would then be passed to Vue's rendering engine, which, with the runtime compiler enabled, would execute the attacker-controlled template on the server. The security patch addresses this by modifying getIslandContext to invoke a new helper function, findUnsafeIslandPropKey, which recursively scans the props for a template key. If this key is found and the runtime compiler is enabled, the request is rejected with a 400 error, effectively closing the RCE vector. Therefore, getIslandContext is the key function that would appear in a runtime profile during an exploit attempt.
getIslandContextpackages/nitro-server/src/runtime/handlers/island.ts