CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2026-34405
Medium (6.1) in nuxt og image. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in nuxt-og-image 6.2.5.
Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in version 6.2.5.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nuxt:og_image
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mg36-wvcr-m75h | npm | nuxt-og-image | <6.2.5 | 6.2.5 |