Skip to content

chore(deps): update dependency @nuxt/ui to v4 [security] - #143

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nuxt-ui-vulnerability
Open

chore(deps): update dependency @nuxt/ui to v4 [security]#143
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nuxt-ui-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@nuxt/ui (source) ^3.0.0 → ^4.0.0 age confidence

@​nuxt/ui: UAuthForm / UForm SSR markup omits method, leaking credentials via GET if submitted before hydration

GHSA-gj2h-2fpw-fhv9

More information

Details

Summary

UForm and UAuthForm render a server-side <form> element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler (autofill plus Enter on a slow network, JS bundle blocked by CSP or CDN failure, etc.), the browser performs the native default: a GET to the current URL with every named field, including <input type="password">, serialised into the query string.

Details

src/runtime/components/Form.vue (around the template's <form> element) emits:

<component
  :is="parentBus ? 'div' : 'form'"
  :id="formId"
  ref="formRef"
  :class="ui({ class: [uiProp?.base, props.class] })"
  @submit.prevent="onSubmitWrapper"
>

No method, no action. @submit.prevent is the only thing stopping native submission, and it only exists after hydration. UAuthForm composes UForm and inherits the same shape.

The SSR snapshot of UAuthForm (test/components/__snapshots__/AuthForm.spec.ts.snap) shows the rendered markup, with <input type="password" name="password"> inside a <form> that has no method.

Proof of concept

Reported by @​nimonian:

  1. Create a minimal Nuxt app with a UAuthForm.
  2. Build for production and visit in a browser with network throttling at 4G or slower.
  3. Enter credentials.
  4. Submit (or let autofill + Enter fire before hydration).

The URL becomes /login?email=…&password=…. Reproducible deterministically in Playwright by triggering submit immediately on load.

Impact

Any application using UAuthForm (or UForm with credential-shaped fields) as documented. The cleartext password lands in:

  • the address bar,
  • window.history,
  • the Referer header of every same-origin subresource fetched from the resulting URL,
  • access logs of any reverse proxy, CDN, or WAF that records request URLs.
Patch

Default the rendered <form> to method="post" so the pre-hydration fallback submits as POST rather than GET. Vue's @submit.prevent still intercepts the hydrated case; the attribute only matters in the race window. Applications that explicitly want native GET submission can opt back in by passing method="get".

Credit

Reported by @​nimonian. Originally filed as GHSA-92g7-2fpq-hmq8 against nuxt/nuxt; moved here because the affected code lives in @nuxt/ui.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nuxt/ui (@​nuxt/ui)

v4.8.1

Compare Source

Bug Fixes
  • ContentSearch/DashboardSearch: proxy missing CommandPalette props (#​6505) (631f5dc)
  • Form: add method="post" to prevent credential leaking via GET before hydration (#​6512) (7a0825a)
  • Icon: avoid recursive icon resolution (#​6495) (d50c121)
  • locale: improve Thai translation accuracy and consistency (#​6509) (5d82418)
  • module: expose component theme keys in AppConfig type (#​6520) (ffaf163)
  • module: revert tagPriority to -2 for inline style tag (2dac778)
  • Select/SelectMenu/InputMenu: add fallback for max-height (#​6503) (f4d7cbe)

v4.8.0

Compare Source

⚠ BREAKING CHANGES
  • InputMenu: rename autocomplete prop to mode to free up HTML attribute (#​6474)
Features
  • Avatar/AvatarGroup: add color prop (#​6405) (6f2396f)
  • Breadcrumb: add color prop (#​6406) (955dac1)
  • ChatMessage: add body slot and improve actions alignment (#​6460) (48685b6)
  • ChatMessage: add color prop and header slot (#​6407) (c6ce8ca)
  • ChatPrompt: add submitOnEnter prop to control Enter behavior (b597f90), closes #​6177
  • Checkbox/RadioGroup/Switch: add highlight prop for error ring styling (a0deee4)
  • CommandPalette: search and highlight description field (524c34d)
  • ContentSearch/DashboardSearch: enable Fuse.js token search by default (ba08220)
  • ContentSearch: add async search support via useSearchCollection (#​6432) (a1bef8b)
  • DashboardGroup: add storageOptions prop (8f0101b), closes #​6170
  • Error: add icon prop and leading slot (e6ea707), closes #​6119
  • Separator: add position prop (#​6415) (844660a)
  • Theme: override component prop defaults (#​6031) (71c008e)
Bug Fixes
  • ChatMessage: add wrap-break-word to content slot (#​6476) (eb468e6)
  • CommandPalette: only split tokens in highlight when useTokenSearch is enabled (898fbce)
  • CommandPalette: preserve relative order of ignoreFilter groups (e4c1787)
  • CommandPalette: re-highlight first item after debounced results render (efd7b8e)
  • CommandPalette: update default fuse keys in docs and search components (0d9cc0d)
  • components: apply theme.prefix to hardcoded utility classes (f51b1e8)
  • components: constrain popper content to available viewport height (007b136), closes #​6449
  • ContentSearch: preserve intermediate ancestors in breadcrumb prefix (#​6466) (f639b19)
  • ContentToc: apply ui.trigger prop to trigger elements (252b906), closes #​6428
  • defineShortcuts: use e.code for alt shortcuts to handle macOS key remapping (231f156), closes #​6444
  • FileUpload: pass disabled attribute to button variant (2890c83), closes #​6420
  • Form: improve errors type (#​6208) (c1090ab)
  • InputMenu/Select/SelectMenu: respect trailing: false over default trailingIcon (#​6457) (65b47ce)
  • InputMenu: rename autocomplete prop to mode to free up HTML attribute (#​6474) (2799fa6)
  • module: don't require @nuxtjs/mdc when using content option (89f7778)
  • module: pass computed ref directly to useHead innerHTML (00b7476)
  • module: ship stripped [#build](https://redirect.github.com/nuxt/ui/issues/build)/ui.css fallback for tooling (083c2a9), closes #​5504
  • ProseKbd: add default slot and make value optional (f317c7f)
  • Textarea: autoresize on mount with pre-filled value (e96a0b6), closes #​5962
  • useComponentProps: treat array-typed theme values as ClassValue leaves (cac3860)

v4.7.1

Compare Source

Bug Fixes
  • ChatMessage: make actions slot accessible on touch devices (f5a3349)
  • Drawer: handle RTL mode (#​6396) (2e3fed2)
  • Link: prevent double-prefixing with @nuxtjs/i18n auto-localization (#​6404) (dde09d0)
  • ProseImg: close zoom overlay on Escape key (e3cdbc5)
  • ProsePrompt: improve responsive (0a5b433)

v4.7.0

Compare Source

Features
Bug Fixes
  • Accordion/Tabs: use item value as stable key to avoid remounts (#​6380) (3cee610)
  • Avatar: remove leading-none from fallback (#​6383) (77ce09a)
  • ChatMessage/ChatMessages: preserve generic message type in slot scope (#​6391) (20f66db)
  • ChatMessages: prevent layout shift caused by indicator during streaming (#​6297) (b7160e2)
  • ChatMessages: use MutationObserver for auto-scroll during streaming (#​6357) (47bf3cb)
  • ChatPromptSubmit: ignore disabled prop when status is not ready (600a2ca)
  • components: resolve defaultVariants in template logic (#​6361) (75b37d0)
  • ContentSearch/DashboardSearch: pick shared props from CommandPalette (cdcf2e5)
  • ContentSearch: speed up navigation mapping (0faf2c2)
  • ContentToc: use links for scrollspy instead of hardcoded h2/h3 (#​6282) (6aba2ea)
  • FieldGroup: prevent context from leaking into portals (#​6313) (5155e27)
  • FileUpload: use form field color and highlight instead of raw props (bb5a9ed)
  • Header/DashboardSidebar/Sidebar: allow auto focus in menu for proper focus trapping (#​6266) (9b91ee4)
  • InputDate/InputTime: increase segments width (#​6339) (4ebdb2f)
  • InputTags: add missing field group variant (#​6326) (aae5378)
  • Link: ensure single-root rendering for v-show and $el resolution (#​6310) (2c4ff35)
  • Modal/Slideover: drop empty header wrapper when empty (#​6381) (1082960)
  • module: use relative tagPriority for inline style tags (#​6299) (ae693d0)
  • PricingTable: align header elements vertically (#​6111) (0daacb0)
  • PricingTable: handle RTL mode (#​6382) (ab203db)
  • ProseCodeCollapse: match background on overscroll (28c89fe)
  • ProseImg: respect markdown width attribute (#​6350) (d4e4ea1)
  • ProsePre: get code from DOM if code prop is missing (#​6333) (b808ce4)
  • Select: support item-aligned position mode (#​6358) (255807a)

v4.6.1

Compare Source

Bug Fixes
  • ai: use part.state for streaming detection and deprecate isReasoningStreaming (d2d7543)
  • ChatMessage: hide files slot when no file parts exist (9cddc8e)
  • ChatMessages: keep indicator visible until first content arrives (195cce8)
  • ChatMessages: reset scroll icon when messages are cleared (#​6239) (4ba3eef)
  • ChatPrompt: guard enter during composition (#​6280) (a911ca8)
  • DashboardSidebar: always pass collapsed: false in mobile menu slots (957a0f5), closes #​6157
  • Modal/Slideover/Drawer: suppress reka ui title and description warnings (3451b8d), closes #​6240
  • module: inline defaultVariants and prefix in dev template (314e23b)
  • module: transpile reka-ui to prevent injection errors (#​6286) (b822c43)

v4.6.0

Compare Source

⚠ BREAKING CHANGES
  • module: use moduleDependencies to manipulate options (#​5384)
Features
Bug Fixes
  • Avatar: use resolved size for image width/height (#​6008) (6dd0fc4)
  • ChatShimmer: handle RTL mode (#​6180) (51793a8)
  • ContentNavigation: prevent toggling disabled parent items (#​6122) (0f1074f)
  • ContentSurround: handle RTL mode (#​6148) (6921f13)
  • ContentToc: reset start margin at lg breakpoint (8f24f79)
  • DashboardSearchButton: use valid HTML structure for trailing slot (#​6194) (578a12f)
  • Editor: guard lift calls for unavailable list extensions (#​6100) (065db6b)
  • Error: support status and statusText properties (1350d62), closes #​6134
  • FileUpload: make multiple, accept and reset options reactive (#​6204) (ae093df)
  • Modal/Slideover/Popover/Drawer: prevent double close:prevent emit (#​6226) (9a0d501)
  • module: only auto-import public composables and allow Vite opt-out (#​6197) (886f5fb)
  • NavigationMenu: improve RTL support for viewport and indicator (#​6164) (755867b)
  • NavigationMenu: propagate disabled state to item in vertical orientation (6d4d651)
  • ProsePre: move shiki line highlight styles to theme (d663950)

v4.5.1

Compare Source

Bug Fixes
  • components: improve arrow styling with stroke-default and fill-bg (#​6095) (0e9198e)
  • components: improve slots return types and tests (#​6109) (7d1e863)
  • components: prevent transformUI from mutating cached useComponentUI value (286738a), closes #​6104 #​4387
  • ContentToc: add relative positioning to content slot (fcdb231), closes #​6117
  • ContentToc: use rem units for indicator size calculation (d631853)
  • NavigationMenu: prevent navigation when clicking trailing area in horizontal orientation (8f84c90), closes #​6083
  • Page: make slot presence reactive for variant computation (082ea41)
  • types: resolve isArrayOfArray type return (#​6097) (04292d9)
  • useResizable: use function declaration to prevent false auto-import (c22ecf4)

v4.5.0

Compare Source

Features
  • DashboardSidebar/Header: add autoClose prop (#​6089) (2663deb)
  • EditorDragHandle: proxy nested / nestedOptions props and emit hover event (#​5960) (ed60193)
  • Form: add HTML5 validation to programmatic submit (#​6002) (ed552fc)
  • locale: add Belarusian language (#​5972) (ac9e7b3)
  • module: add support for taupe / mauve / mist / olive neutral colors (#​6081) (bc49d3f)
  • NavigationMenu: allow tooltip usage in horizontal orientation (#​5682) (f46b504)
  • NavigationMenu: handle chip in items (#​6064) (401a2c0)
  • ScrollArea: add skipMeasurement virtualize option (#​5721) (548b711)
  • Select/SelectMenu: add hover effects on outline and subtle variants (94b0c31)
  • Theme: new component (#​4387) (c97047d)
  • Toaster: prevent duplicate toasts and add pulse animation (3f6581a)
Bug Fixes
  • BlogPost/ChangelogVersion: use ImgHTMLAttributes type for image prop (#​6007) (0185856)
  • ChatMessages: allow message props to override role defaults (#​6000) (f64ec17)
  • ChatMessages: prevent flash at top before scrolling to bottom on mount (4bdcb83)
  • Checkbox/Switch: prevent data-state conflict when used inside Tooltip (2bb1a8b), closes #​3599
  • CheckboxGroup: update update:modelValue emit type (#​5927) (64d2e88)
  • ColorModeImage: add baseURL support for public paths (#​6006) (db510f3)
  • components: add fixed prop to prevent responsive text size reduction (#​6074) (8f5f44c)
  • components: nullable and optional type support (#​6060) (cd3432b)
  • components: prevent iOS auto-zoom on input fields with font-size below 16px (#​6040) (1262016)
  • ContentNavigation: pass nested child data to slots (#​6043) (e67f77e)
  • defineShortcuts: add alt key guard (#​6020) (8451f45)
  • defineShortcuts: allow shifted special character shortcuts (08facc0)
  • Drawer/Modal/Popover/Slideover: prevent unexpected close on touch when interacting with other overlays (#​5695) (e2c038c)
  • Editor: handle placeholder in RTL mode (#​5977) (3cc16e3)
  • EditorMentionMenu: use char prop as mention prefix instead of always @ (0b9b097), closes #​6035
  • EditorToolbar: proxy size prop to dropdown menu (8f8d989)
  • InputMenu/InputNumber/SelectMenu: proxy size to buttons (1ec1698), closes #​5958
  • InputMenu/Select/SelectMenu: exclude cosmetic items from model value type (#​6044) (22cf1ea)
  • InputMenu/SelectMenu: sort filtered items by match relevance (058c66b), closes #​4672
  • InputMenu: prevent focus on trailing button (88073b6)
  • module: update icon cssLayer option from components to base (#​6076) (e8bc322)
  • NavigationMenu: allow clicking trailing slot in horizontal orientation (7f9996f), closes #​5192 #​6083
  • NavigationMenu: unique auto-generated item values for grouped items (7b317d9)
  • PricingPlan: truncate title (#​6041) (8e86c51)
  • Select: remove useless by prop (14dceaf)
  • Table: improve perfs with shallowRef when watch deep is disabled (#​6023) (bc06ce2)
  • Toast: allow update to keep toast open and reset duration (82afa0a)
  • Toast: improve animation smoothness (#​6065) (ee2c0a5)
  • types: improve DotPathKeys accuracy and GetItemKeys performance (#​6077) (6f7af3e)
  • useEditorMenu: rank filtered results by relevance (f53484a)

v4.4.0

Compare Source

Features
Bug Fixes
  • Banner: isolate banner visibility using per-instance CSS variables (#​5751) (c7332eb)
  • Banner: prevent XSS via id prop injection (4e334a0)
  • CommandPalette/ContextMenu/DropdownMenu: keyboard selection on link items (3f5bdb3)
  • CommandPalette: prevent XSS in search highlight (e12ceb6)
  • ContentSurround: align next link to right on tablet without prev (#​5833) (b3adccc)
  • defineShortcuts: check shift modifier for special character shortcuts (bd344d7), closes #​5911
  • Editor: set contentType when updating value (c37d6f7), closes #​5709
  • Editor: support all heading levels by default (3046c3e)
  • EditorToolbar: prevent onClick from being called twice on items (cbed0cc), closes #​5784
  • EditorToolbar: prevent disabled dropdown when items have no kind (d473f63)
  • Error/Main: render as main instead of div (6ccb1f5)
  • FileUpload: emit null when clearing file (#​5892) (1d9a2fd)
  • FileUpload: keep input visible when preview is disabled with multiple files (597ac29), closes #​5875
  • locale: improve cs and sk terminology for correct inflection (#​5789) (af6f288)
  • module: only override primary color and md size default variants (f422de8)
  • ProseCodeTree: prevent infinite update loop with expandAll prop (c79cb77), closes #​5828
  • useOverlay: refine close event argument extraction (#​5775) (182af20)

v4.3.0

Compare Source

Features
Bug Fixes
  • BlogPost/ChangelogVersion/PageFeature/User: allow tab focus (47d93d3), closes #​5635
  • Carousel: consistent stopOnInteraction behavior (#​5489) (36a7861)
  • Carousel: improve dots focus styles (cc90fb8)
  • ColorModeButton: improve icon class merging (2ce9af2)
  • ContentSearch/DasboardSearch: set full height on mobile to prevent jump (70317e5)
  • DashboardResizeHandle: allow hover over panel with z-index (07147f1)
  • EditorDragHandle: add missing UButton import (1b850bb)
  • EditorToolbar: map dropdown items recursively to support kind (feb756d)
  • FormField: hide error if error prop is false (#​5599) (6b7fe25)
  • InputDate/InputTime: add missing field group variant (#​5596) (cb3cec2)
  • PageCard/PageCTA/PageSection: handle reverse prop under lg screens (#​5545) (60b430c)
  • ProseA/ProseCallout/ProseCard: improve focus styles (df5f8c2)
  • Slider: add aria-label to thumb (#​5313) (f99ec46)
  • Table: only forward necessary props (#​5527) (b0b209e)
  • Table: properly position pinned columns based on size (e885b0e), closes #​4721 #​3927

v4.2.1

Compare Source

Bug Fixes

v4.2.0

Compare Source

⚠ BREAKING CHANGES

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov

codecov Bot commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.76%. Comparing base (6fe2c97) to head (136d791).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #143   +/-   ##
=======================================
  Coverage   99.76%   99.76%           
=======================================
  Files          76       76           
  Lines        1284     1284           
  Branches      324      324           
=======================================
  Hits         1281     1281           
  Misses          3        3

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate
renovate Bot force-pushed the renovate/npm-nuxt-ui-vulnerability branch from fad78a7 to 656a104 Compare August 11, 2026 23:30
@Decipher Decipher mentioned this pull request Aug 12, 2026
Merged
4 tasks
@renovate
renovate Bot force-pushed the renovate/npm-nuxt-ui-vulnerability branch from 656a104 to 136d791 Compare August 13, 2026 05:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants