{"answers":{"affected":"2 open source packages ship an affected version, including @nuxt/ui.","exploited":"There is no known exploitation of GHSA-gj2h-2fpw-fhv9 in the wild and no public exploit code.","fix":"Upgrade @nuxt/ui to 4.8.1 or later.","what":"GHSA-gj2h-2fpw-fhv9 is a vulnerability in @nuxt/ui, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-gj2h-2fpw-fhv9 and fix it if it is affected.\n\nWhat it is: GHSA-gj2h-2fpw-fhv9 is a vulnerability in @nuxt/ui, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-gj2h-2fpw-fhv9 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @nuxt/ui (npm): affected all versions; fixed in 4.8.1\n- @nuxt/ui (npm): affected all versions; fixed in 4.8.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-gj2h-2fpw-fhv9/ (Markdown: https://insights.sbomify.com/GHSA-gj2h-2fpw-fhv9/index.md)","id":"GHSA-gj2h-2fpw-fhv9","markdown":"https://insights.sbomify.com/GHSA-gj2h-2fpw-fhv9/index.md","name":"GHSA-gj2h-2fpw-fhv9","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Nuxt UI library","requires_auth":"none","summary":"SSR forms omit method attribute, causing credentials to leak in URL query strings if submitted before JavaScript hydration completes.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\n`UForm` and `UAuthForm` render a server-side `\u003cform\u003e` element with no `method` and no `action` attribute, relying on a hydrated `@submit.prevent` handler to intercept submission. If a user submits the form before Vue hydration has attached the handler (autofill plus Enter on a slow network, JS bundle blocked by CSP or CDN failure, etc.), the browser performs the native default: a `GET` to the current URL with every named field, including `\u003cinput type=\"password\"\u003e`, serialised into the query string.\n\n### Details\n\n`src/runtime/components/Form.vue` (around the template's `\u003cform\u003e` element) emits:\n\n```vue\n\u003ccomponent\n  :is=\"parentBus ? 'div' : 'form'\"\n  :id=\"formId\"\n  ref=\"formRef\"\n  :class=\"ui({ class: [uiProp?.base, props.class] })\"\n  @submit.prevent=\"onSubmitWrapper\"\n\u003e\n```\n\nNo `method`, no `action`. `@submit.prevent` is the only thing stopping native submission, and it only exists after hydration. `UAuthForm` composes `UForm` and inherits the same shape.\n\nThe SSR snapshot of `UAuthForm` (`test/components/__snapshots__/AuthForm.spec.ts.snap`) shows the rendered markup, with `\u003cinput type=\"password\" name=\"password\"\u003e` inside a `\u003cform\u003e` that has no `method`.\n\n### Proof of concept\n\nReported by @nimonian:\n\n1. Create a minimal Nuxt app with a `UAuthForm`.\n2. Build for production and visit in a browser with network throttling at 4G or slower.\n3. Enter credentials.\n4. Submit (or let autofill + Enter fire before hydration).\n\nThe URL becomes `/login?email=…\u0026password=…`. Reproducible deterministically in Playwright by triggering submit immediately on `load`.\n\n### Impact\n\nAny application using `UAuthForm` (or `UForm` with credential-shaped fields) as documented. The cleartext password lands in:\n\n- the address bar,\n- `window.history`,\n- the `Referer` header of every same-origin subresource fetched from the resulting URL,\n- access logs of any reverse proxy, CDN, or WAF that records request URLs.\n\n### Patch\n\nDefault the rendered `\u003cform\u003e` to `method=\"post\"` so the pre-hydration fallback submits as POST rather than GET. Vue's `@submit.prevent` still intercepts the hydrated case; the attribute only matters in the race window. Applications that explicitly want native GET submission can opt back in by passing `method=\"get\"`.\n\n### Credit\n\nReported by @nimonian. Originally filed as `GHSA-92g7-2fpq-hmq8` against `nuxt/nuxt`; moved here because the affected code lives in `@nuxt/ui`.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration","id":"GHSA-gj2h-2fpw-fhv9","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["4.8.1"],"introduced":["0"],"last_affected":[],"package":"@nuxt/ui","purl":null,"source":"GHSA-gj2h-2fpw-fhv9"},{"ecosystem":"npm","fixed":["4.8.1"],"introduced":["0"],"last_affected":[],"package":"@nuxt/ui","purl":"pkg:npm/%40nuxt/ui","source":"GHSA-gj2h-2fpw-fhv9"}],"products":null,"published":"2026-07-02","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"SSR forms omit method attribute, causing credentials to leak in URL query strings if submitted before JavaScript hydration completes.","url":"https://insights.sbomify.com/GHSA-gj2h-2fpw-fhv9/"}