Skip to content

chore(deps): update dependency @nuxt/ui to v4.8.1 [security] - #253

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nuxt-ui-vulnerability
Open

chore(deps): update dependency @nuxt/ui to v4.8.1 [security]#253
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nuxt-ui-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@nuxt/ui (source) 4.5.1 → 4.8.1 age confidence

@​nuxt/ui: UAuthForm / UForm SSR markup omits method, leaking credentials via GET if submitted before hydration

GHSA-gj2h-2fpw-fhv9

More information

Details

Summary

UForm and UAuthForm render a server-side <form> element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler (autofill plus Enter on a slow network, JS bundle blocked by CSP or CDN failure, etc.), the browser performs the native default: a GET to the current URL with every named field, including <input type="password">, serialised into the query string.

Details

src/runtime/components/Form.vue (around the template's <form> element) emits:

<component
  :is="parentBus ? 'div' : 'form'"
  :id="formId"
  ref="formRef"
  :class="ui({ class: [uiProp?.base, props.class] })"
  @submit.prevent="onSubmitWrapper"
>

No method, no action. @submit.prevent is the only thing stopping native submission, and it only exists after hydration. UAuthForm composes UForm and inherits the same shape.

The SSR snapshot of UAuthForm (test/components/__snapshots__/AuthForm.spec.ts.snap) shows the rendered markup, with <input type="password" name="password"> inside a <form> that has no method.

Proof of concept

Reported by @​nimonian:

  1. Create a minimal Nuxt app with a UAuthForm.
  2. Build for production and visit in a browser with network throttling at 4G or slower.
  3. Enter credentials.
  4. Submit (or let autofill + Enter fire before hydration).

The URL becomes /login?email=…&password=…. Reproducible deterministically in Playwright by triggering submit immediately on load.

Impact

Any application using UAuthForm (or UForm with credential-shaped fields) as documented. The cleartext password lands in:

  • the address bar,
  • window.history,
  • the Referer header of every same-origin subresource fetched from the resulting URL,
  • access logs of any reverse proxy, CDN, or WAF that records request URLs.
Patch

Default the rendered <form> to method="post" so the pre-hydration fallback submits as POST rather than GET. Vue's @submit.prevent still intercepts the hydrated case; the attribute only matters in the race window. Applications that explicitly want native GET submission can opt back in by passing method="get".

Credit

Reported by @​nimonian. Originally filed as GHSA-92g7-2fpq-hmq8 against nuxt/nuxt; moved here because the affected code lives in @nuxt/ui.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nuxt/ui (@​nuxt/ui)

v4.8.1

Compare Source

Bug Fixes
  • ContentSearch/DashboardSearch: proxy missing CommandPalette props (#​6505) (631f5dc)
  • Form: add method="post" to prevent credential leaking via GET before hydration (#​6512) (7a0825a)
  • Icon: avoid recursive icon resolution (#​6495) (d50c121)
  • locale: improve Thai translation accuracy and consistency (#​6509) (5d82418)
  • module: expose component theme keys in AppConfig type (#​6520) (ffaf163)
  • module: revert tagPriority to -2 for inline style tag (2dac778)
  • Select/SelectMenu/InputMenu: add fallback for max-height (#​6503) (f4d7cbe)

v4.8.0

Compare Source

⚠ BREAKING CHANGES
  • InputMenu: rename autocomplete prop to mode to free up HTML attribute (#​6474)
Features
  • Avatar/AvatarGroup: add color prop (#​6405) (6f2396f)
  • Breadcrumb: add color prop (#​6406) (955dac1)
  • ChatMessage: add body slot and improve actions alignment (#​6460) (48685b6)
  • ChatMessage: add color prop and header slot (#​6407) (c6ce8ca)
  • ChatPrompt: add submitOnEnter prop to control Enter behavior (b597f90), closes #​6177
  • Checkbox/RadioGroup/Switch: add highlight prop for error ring styling (a0deee4)
  • CommandPalette: search and highlight description field (524c34d)
  • ContentSearch/DashboardSearch: enable Fuse.js token search by default (ba08220)
  • ContentSearch: add async search support via useSearchCollection (#​6432) (a1bef8b)
  • DashboardGroup: add storageOptions prop (8f0101b), closes #​6170
  • Error: add icon prop and leading slot (e6ea707), closes #​6119
  • Separator: add position prop (#​6415) (844660a)
  • Theme: override component prop defaults (#​6031) (71c008e)
Bug Fixes
  • ChatMessage: add wrap-break-word to content slot (#​6476) (eb468e6)
  • CommandPalette: only split tokens in highlight when useTokenSearch is enabled (898fbce)
  • CommandPalette: preserve relative order of ignoreFilter groups (e4c1787)
  • CommandPalette: re-highlight first item after debounced results render (efd7b8e)
  • CommandPalette: update default fuse keys in docs and search components (0d9cc0d)
  • components: apply theme.prefix to hardcoded utility classes (f51b1e8)
  • components: constrain popper content to available viewport height (007b136), closes #​6449
  • ContentSearch: preserve intermediate ancestors in breadcrumb prefix (#​6466) (f639b19)
  • ContentToc: apply ui.trigger prop to trigger elements (252b906), closes #​6428
  • defineShortcuts: use e.code for alt shortcuts to handle macOS key remapping (231f156), closes #​6444
  • FileUpload: pass disabled attribute to button variant (2890c83), closes #​6420
  • Form: improve errors type (#​6208) (c1090ab)
  • InputMenu/Select/SelectMenu: respect trailing: false over default trailingIcon (#​6457) (65b47ce)
  • InputMenu: rename autocomplete prop to mode to free up HTML attribute (#​6474) (2799fa6)
  • module: don't require @nuxtjs/mdc when using content option (89f7778)
  • module: pass computed ref directly to useHead innerHTML (00b7476)
  • module: ship stripped [#build](https://redirect.github.com/nuxt/ui/issues/build)/ui.css fallback for tooling (083c2a9), closes #​5504
  • ProseKbd: add default slot and make value optional (f317c7f)
  • Textarea: autoresize on mount with pre-filled value (e96a0b6), closes #​5962
  • useComponentProps: treat array-typed theme values as ClassValue leaves (cac3860)

v4.7.1

Compare Source

Bug Fixes
  • ChatMessage: make actions slot accessible on touch devices (f5a3349)
  • Drawer: handle RTL mode (#​6396) (2e3fed2)
  • Link: prevent double-prefixing with @nuxtjs/i18n auto-localization (#​6404) (dde09d0)
  • ProseImg: close zoom overlay on Escape key (e3cdbc5)
  • ProsePrompt: improve responsive (0a5b433)

v4.7.0

Compare Source

Features
Bug Fixes
  • Accordion/Tabs: use item value as stable key to avoid remounts (#​6380) (3cee610)
  • Avatar: remove leading-none from fallback (#​6383) (77ce09a)
  • ChatMessage/ChatMessages: preserve generic message type in slot scope (#​6391) (20f66db)
  • ChatMessages: prevent layout shift caused by indicator during streaming (#​6297) (b7160e2)
  • ChatMessages: use MutationObserver for auto-scroll during streaming (#​6357) (47bf3cb)
  • ChatPromptSubmit: ignore disabled prop when status is not ready (600a2ca)
  • components: resolve defaultVariants in template logic (#​6361) (75b37d0)
  • ContentSearch/DashboardSearch: pick shared props from CommandPalette (cdcf2e5)
  • ContentSearch: speed up navigation mapping (0faf2c2)
  • ContentToc: use links for scrollspy instead of hardcoded h2/h3 (#​6282) (6aba2ea)
  • FieldGroup: prevent context from leaking into portals (#​6313) (5155e27)
  • FileUpload: use form field color and highlight instead of raw props (bb5a9ed)
  • Header/DashboardSidebar/Sidebar: allow auto focus in menu for proper focus trapping (#​6266) (9b91ee4)
  • InputDate/InputTime: increase segments width (#​6339) (4ebdb2f)
  • InputTags: add missing field group variant (#​6326) (aae5378)
  • Link: ensure single-root rendering for v-show and $el resolution (#​6310) (2c4ff35)
  • Modal/Slideover: drop empty header wrapper when empty (#​6381) (1082960)
  • module: use relative tagPriority for inline style tags (#​6299) (ae693d0)
  • PricingTable: align header elements vertically (#​6111) (0daacb0)
  • PricingTable: handle RTL mode (#​6382) (ab203db)
  • ProseCodeCollapse: match background on overscroll (28c89fe)
  • ProseImg: respect markdown width attribute (#​6350) (d4e4ea1)
  • ProsePre: get code from DOM if code prop is missing (#​6333) (b808ce4)
  • Select: support item-aligned position mode (#​6358) (255807a)

v4.6.1

Compare Source

Bug Fixes
  • ai: use part.state for streaming detection and deprecate isReasoningStreaming (d2d7543)
  • ChatMessage: hide files slot when no file parts exist (9cddc8e)
  • ChatMessages: keep indicator visible until first content arrives (195cce8)
  • ChatMessages: reset scroll icon when messages are cleared (#​6239) (4ba3eef)
  • ChatPrompt: guard enter during composition (#​6280) (a911ca8)
  • DashboardSidebar: always pass collapsed: false in mobile menu slots (957a0f5), closes #​6157
  • Modal/Slideover/Drawer: suppress reka ui title and description warnings (3451b8d), closes #​6240
  • module: inline defaultVariants and prefix in dev template (314e23b)
  • module: transpile reka-ui to prevent injection errors (#​6286) (b822c43)

v4.6.0

Compare Source

⚠ BREAKING CHANGES
  • module: use moduleDependencies to manipulate options (#​5384)
Features
Bug Fixes
  • Avatar: use resolved size for image width/height (#​6008) (6dd0fc4)
  • ChatShimmer: handle RTL mode (#​6180) (51793a8)
  • ContentNavigation: prevent toggling disabled parent items (#​6122) (0f1074f)
  • ContentSurround: handle RTL mode (#​6148) (6921f13)
  • ContentToc: reset start margin at lg breakpoint (8f24f79)
  • DashboardSearchButton: use valid HTML structure for trailing slot (#​6194) (578a12f)
  • Editor: guard lift calls for unavailable list extensions (#​6100) (065db6b)
  • Error: support status and statusText properties (1350d62), closes #​6134
  • FileUpload: make multiple, accept and reset options reactive (#​6204) (ae093df)
  • Modal/Slideover/Popover/Drawer: prevent double close:prevent emit (#​6226) (9a0d501)
  • module: only auto-import public composables and allow Vite opt-out (#​6197) (886f5fb)
  • NavigationMenu: improve RTL support for viewport and indicator (#​6164) (755867b)
  • NavigationMenu: propagate disabled state to item in vertical orientation (6d4d651)
  • ProsePre: move shiki line highlight styles to theme (d663950)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from danielroe as a code owner August 5, 2026 07:59
@vercel

vercel Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples Error Error Aug 6, 2026 1:13pm

Request Review

@socket-security

socket-security Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​nuxt/​ui@​4.8.19710010098100

View full report

@renovate
renovate Bot force-pushed the renovate/npm-nuxt-ui-vulnerability branch from b530ffa to 2530632 Compare August 6, 2026 12:51
@renovate
renovate Bot force-pushed the renovate/npm-nuxt-ui-vulnerability branch from 2530632 to 40e7a0d Compare August 6, 2026 13:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danielroe danielroe Awaiting requested review from danielroe danielroe is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants