CVE-2026-45669

Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigateTo() with external: true generates a server-side HTML redirect body containing a <meta http-equiv="refresh"> tag. The destination URL is only sanitized by replacing " with %22, leaving <, >, &, and ' unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content="…" attribute and inject arbitrary HTML/JavaScript that executes under the application's origin. This issue has been patched in versions 3.21.6 and 4.4.6.

• CWE-83

• https://github.com/nuxt/nuxt/pull/35052Issue Tracking
• https://github.com/nuxt/nuxt/security/advisories/GHSA-fx6j-w5w5-h468Exploit, Patch, Vendor Advisory
• https://github.com/nuxt/nuxt/security/advisories/GHSA-fx6j-w5w5-h468Exploit, Patch, Vendor Advisory

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45663Dokploy is a free, self-hostable Platform as a Service (PaaS…9.9
• CVE-2026-45664ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-45665Open WebUI is a self-hosted artificial intelligence platform…8.1
• CVE-2026-45666Open WebUI is a self-hosted artificial intelligence platform…6.5
• CVE-2026-45667Open WebUI is a self-hosted artificial intelligence platform…6.5
• CVE-2026-45668Trilium Notes is a cross-platform, hierarchical note taking …9.3
• CVE-2026-4567A vulnerability has been found in Tenda A15 15.13.07.13. The…9.8
• CVE-2026-45670Nuxt is an open-source web development framework for Vue.js.…5.4
• CVE-2026-45671Open WebUI is a self-hosted artificial intelligence platform…8
• CVE-2026-45672Open WebUI is a self-hosted artificial intelligence platform…8.8
• CVE-2026-45673Netty is a network application framework for development of …6.8
• CVE-2026-45674Netty is a network application framework for development of …10