GHSA-mg36-wvcr-m75h
Medium · 6.1CVSS
6.1
EPSS
—
Published
Mar 31, 2026
CISA due date
—
The record
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | nuxt-og-image | 0 | 6.2.5 |
Related vulnerabilities
- CVE-2026-34405 Nuxt OG Image generates OG Images with Vue templates in Nuxt. Same vulnerability
- CVE-2026-44589 Nuxt OG Image generates OG Images with Vue templates in Nuxt. Also affects nuxt-og-image
- GHSA-c2rm-g55x-8hr5 nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) Also affects nuxt-og-image
- GHSA-pqhr-mp3f-hrpp Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters Also affects nuxt-og-image
- GHSA-c7xp-q6q8-hg76 Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions Also affects nuxt-og-image
- CVE-2026-34404 Nuxt OG Image generates OG Images with Vue templates in Nuxt. Also affects nuxt-og-image
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79