CVE-2026-56317

LowPublic PoC

Published: 20 June 2026

Published

20 June 2026

Modified

24 June 2026

KEV Added

—

Patch

—

CVSS Score v4 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0021 11.1th percentile

Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-56317 is a low-severity Cross-site Scripting (CWE-79) vulnerability in Nuxt Nuxt. Its CVSS base score is 2.3 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 11.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-38112

Vulnerability details

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query…

parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

XSS in NoScript component directly enables browser script execution (T1059.007) via crafted links/params and supports drive-by compromise (T1189) against application users.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0