CVE-2023-3224: Nuxt code injection before 3.5.3

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction code execution and a very high EPSS percentile make this an urgent patch target despite the thin description.

What it is

Nuxt versions prior to 3.5.3 contain a code injection flaw (CWE-94) in the nuxt/nuxt repository. Because the injected code executes in the application context, it can lead to full compromise of the affected server or build process. The record gives no detail on the specific injection point or required input, so the exact trigger cannot be confirmed from the supplied facts.

Impact

An attacker who can reach the vulnerable code path gains arbitrary code execution, with high impact to confidentiality, integrity and availability per the CVSS vector. This can result in server takeover, data theft or destructive actions.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), so exploitation is remote and unauthenticated. The description does not state which endpoint or input carries the injected code, so the precise entry point is unknown.

Exploitation

Not listed in CISA KEV, but EPSS is 0.58648 (99.06th percentile), indicating a high predicted likelihood of exploitation activity. A public exploit reference is tagged on the huntr.dev advisory, so proof-of-concept material appears to exist.

What to do

• Upgrade Nuxt to 3.5.3 or later, applying the patch commit 65a8f4eb3ef1b249a95fd59e323835a96428baff.
• If immediate upgrade is not possible, restrict network access to the Nuxt application and build tooling to trusted clients only.
• Review and sanitize any user-controlled input that reaches code-generation or template evaluation paths in the application.
• Run the Nuxt service and build process with least privilege and isolate them from sensitive data and internal networks.
• Monitor the Nuxt project and huntr.dev advisory for further details on the injection vector and update mitigations accordingly.

Detection

• Search application and server logs for unexpected code execution, template evaluation errors or anomalous child processes spawned by the Nuxt process.
• Monitor for outbound network connections or file writes originating from the Nuxt runtime that are not part of normal application behavior.
• Audit deployed Nuxt versions and flag any instance below 3.5.3.
• Watch for requests containing code-like payloads or template syntax directed at Nuxt endpoints, and alert on repeated attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.