Description
Product: Nuxt OG Image Version: 6.1.2 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation Description: Incorrect parsing of GET parameters leads to the possibility of HTML injection and JavaScript code injection.
Recommendation
Update the nuxt-og-image package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.2.5
- Patched version(s): 6.2.5
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions - CVE-2026-34404
- Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers - CVE-2026-27902
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag - CVE-2026-30830
You might also like:
See something that needs correcting? Let us knowUpdated April 06, 2026