Loading vulnerability…
CVE-2026-53722 is a reflected DOM-based cross-site scripting vulnerability in Nuxt's <NuxtLink> component. In Nuxt versions prior to 3.21.7 and 4.4.7, values bound to the component's to or href props were rendered into the underlying <a> element's href attribute without validating or sanitizing the URL scheme for external links. If an application passes attacker-controlled input such as a query parameter, CMS field, profile URL, or other untrusted value into <NuxtLink>, an attacker can supply a javascript: or vbscript: URI that is reflected verbatim into the rendered markup. When the victim clicks the link, the browser executes the supplied script in the origin of the Nuxt application. The same unsafe value was also exposed through the component's custom slot via href and route.href, so applications that re-bound those values into their own anchors were similarly affected. The issue was fixed by adding external-href sanitization logic that rejects script-capable protocols and aborts navigation when unsafe values are detected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
data:text/html,... payloads reflected through the same sink do not execute in the application's origin, but can still create a same-tab phishing surface anchored to a legitimate application link.If you can’t patch tonight, do this now.
<NuxtLink :to> or :href. Enforce strict application-side validation and allowlisting of navigation targets. Prefer only safe relative paths beginning with / and not //, or parse supplied URLs and allow only approved schemes such as http: and https:. Review any custom-slot usage that re-binds href or route.href into anchors. A strict Content Security Policy may reduce impact, but it should not be relied on as a complete fix for script-capable URI handling.Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.