GHSA-m3q2-p4fw-w38m: Cross-site scripting via <NoScript> slot content in Nuxt's head components
Nuxt’s globally registered <NoScript> component (from @unhead/vue head components, re-exported by Nuxt) wrote its default-slot content to the innerHTML of the <noscript> head tag, bypassing the HTML escaping that {{ }} interpolation normally applies in Vue templates.
Applications that placed untrusted, attacker-controllable data inside a <NoScript> slot, for example:
<NoScript>{{ route.query.banner }}</NoScript>
would emit that value unescaped inside <noscript> in the server-rendered HTML. With scripting enabled, the HTML parser treats <noscript> content in <head> under the “in head noscript” insertion mode: any tag other than link, meta, noframes, or style implicitly closes <noscript> and is re-processed in the head. A payload such as <script>...</script> therefore escapes the element and executes in the document context.
Sibling head components (<Style>, <Title>) were not affected because they already routed slot text through the safe textContent path.
References
Code Behaviors & Features
Detect and mitigate GHSA-m3q2-p4fw-w38m with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →