CVE-2026-34405: Nuxt OG Image Reflected XSS via Query Parameter Injection
Summary
CVE-2026-34405: Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes. Affects nuxt-og-image versions < 6.2.5. Fixed in 6.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nuxt OG Image is a module designed for generating Open Graph images in Nuxt.js applications. It allows developers to create dynamic images based on the content of their web pages, enhancing social media sharing. However, a vulnerability has been identified in version 6.1.2, where improper handling of GET parameters can lead to reflected cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from incorrect parsing of GET parameters, which allows an attacker to inject arbitrary HTML attributes into the generated page. This can lead to client-side JavaScript execution, enabling attackers to manipulate the page or steal sensitive information, such as cookies. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation, highlighting the risk of HTML injection and JavaScript code execution.
How To Fix
Latest published version: 7.0.7 as of 23 Oct 2026
npm install nuxt-og-image@7.0.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.2.5
This is the first release that contains the fix.
npm install nuxt-og-image@6.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can sanitize the input parameters before they are processed by the nuxt-og-image module. This can be done by implementing a middleware that checks and cleans the GET parameters to prevent malicious input.
Conclusion
The vulnerability identified as CVE-2026-34405 in the nuxt-og-image package poses a significant risk due to its potential for reflected XSS attacks. It is crucial for developers using this package to update to version 6.2.5 or later to protect their applications from exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nuxt-og-image →
FAQ
The vulnerability is a reflected XSS attack that allows attackers to inject malicious HTML attributes via GET parameters.
Versions prior to 6.2.5 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
If an immediate update is not possible, implement input sanitization as a workaround to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for nuxt-og-image.
