CVE-2019-13506

@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.

• CWE-79

• https://github.com/nuxt/devalue/pull/8Patch, Third Party Advisory
• https://github.com/nuxt/devalue/releases/tag/v1.2.3Release Notes, Third Party Advisory
• https://github.com/nuxt/nuxt.js/commit/0d5dfe71917191c5b07f373896311f2d8f6b75bePatch, Third Party Advisory
• https://github.com/nuxt/nuxt.js/compare/c0776eb...8d14cd4Release Notes, Third Party Advisory
• https://github.com/nuxt/nuxt.js/releases/tag/v2.6.2Release Notes, Third Party Advisory
• https://www.npmjs.com/advisories/814Third Party Advisory
• https://github.com/nuxt/devalue/pull/8Patch, Third Party Advisory
• https://github.com/nuxt/devalue/releases/tag/v1.2.3Release Notes, Third Party Advisory
• https://github.com/nuxt/nuxt.js/commit/0d5dfe71917191c5b07f373896311f2d8f6b75bePatch, Third Party Advisory
• https://github.com/nuxt/nuxt.js/compare/c0776eb...8d14cd4Release Notes, Third Party Advisory
• https://github.com/nuxt/nuxt.js/releases/tag/v2.6.2Release Notes, Third Party Advisory
• https://www.npmjs.com/advisories/814Third Party Advisory

Published

Jul 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13497One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allo…6.5
• CVE-2019-13498One Identity Cloud Access Manager 8.1.3 does not use HTTP St…7.4
• CVE-2019-1350A remote code execution vulnerability exists when Git for Vi…8.8
• CVE-2019-13503mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-base…7.5
• CVE-2019-13504There is an out-of-bounds read in Exiv2::MrwImage::readMetad…6.5
• CVE-2019-13505The Appointment Hour Booking plugin 1.1.44 for WordPress all…6.1
• CVE-2019-13507hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.
• CVE-2019-13508FreeTDS through 1.1.11 has a Buffer Overflow.9.8
• CVE-2019-13509In Docker CE and EE before 18.09.8 (as well as Docker EE bef…
• CVE-2019-1351A tampering vulnerability exists when Git for Visual Studio …7.5
• CVE-2019-13510Rockwell Automation Arena Simulation Software versions 16.00…
• CVE-2019-13511Rockwell Automation Arena Simulation Software versions 16.00…3.3