Nuxt Server Islands Vulnerability: Unauthorized Component Instantiation
An early warning has been issued regarding a vulnerability in Nuxt server islands that may allow unauthorized component instantiation via the `/__nuxt_island/` endpoint.
What happened
Reportedly, Nuxt server islands accept props via the `/__nuxt_island/` endpoint, which appears to enable an attacker to instantiate any globally-registered Vue component or native HTML element by passing a plain string value. This could potentially lead to unauthorized component instantiation. The issue is under investigation and the affected components include various versions of 'nuxt' and '@nuxt/ui' packages. It is recommended to avoid using server islands or to ensure that props passed to server islands are properly validated and sanitized to mitigate this risk. Primary sources should be consulted for the most current information and detailed version ranges.
How 0Day mitigates this
nuxt is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.