Cross-Site Scripting in @nuxt/devalue

MEDIO 6.1CVE-2019-13506 · GHSA-6677-83pp-f862 · Published 11/07/2019 · updated 17/06/2026

In breve

CVE-2019-13506 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda @nuxt/devalue (nuxtjs), nuxt.js (nuxtjs), @nuxt/devalue.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 71.6% delle vulnerabilità.
Correzione: aggiornare a 1.2.3, 2.6.2 o successiva.

Package	Affected versions	Patched versions
@nuxt/devalue nuxtjs	`< 1.2.3`	`1.2.3`
nuxt.js nuxtjs	`< 2.6.2`	`2.6.2`
@nuxt/devalue npm	`< 1.2.3`	`1.2.3`

Description

Versions of @nuxt/devalue prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys.

Recommendation

Upgrade to version 1.2.3 or later.

NVD description

@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.

References

nvd.nist.gov/vuln/detail/CVE-2019-13506 · ADVISORY
Rich-Harris/devalue · WEB
nuxt/devalue#8 · WEB
nuxt/nuxt.js commit 0d5dfe7 · WEB
nuxt/devalue release v1.2.3 · WEB
nuxt/nuxt.js · WEB
nuxt/nuxt.js release v2.6.2 · WEB
npmjs.com/advisories/814 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free