CVE-2026-34405 Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes
Attackers can inject arbitrary HTML attributes via query parameters in Nuxt OG Image, leading to reflected XSS and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34405?
CVE-2026-34405 is a medium-severity cross-site scripting vulnerability in nuxt-modules og-image, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in version 6.2.5.
Weakness: CWE-79
Which versions are affected by CVE-2026-34405?
2 open source packages ship an affected version, including nuxt-og-image. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nuxt-og-image npm | All versions | 6.2.5 |
nuxt-og-image npm | All versions | 6.2.5 |
Products include Nuxt Og Image.
How do I fix CVE-2026-34405?
Upgrade nuxt-og-image to 6.2.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-34405 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34405 exists.
Other vulnerabilities in nuxt-modules og-image
Sources
Also known as GHSA-mg36-wvcr-m75h.