CVE-2026-34405 — Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes

CVE-2026-34405

Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes PUBLISHED

Description (CNA)

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in version 6.2.5.

Affected (CNA)

Vendor / product	Versions
nuxt-modules / og-image	affected < 6.2.5

CWE

CWE-79

References

https://github.com/nuxt-modules/og-image/security/advisories/GHSA-mg36-wvcr-m75h

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.