Verified

CVE-2026-102527: og-image >= 6.2.5, < 6.7.0

CVE-2026-102527 affects nuxt-og-image. Affected range: >= 6.2.5, < 6.7.0. Fixed version: 6.7.0.

Affected technology

og-image · >= 6.2.5, < 6.7.0
nuxt-modules

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and availability impact as none; integrity impact as low.

Published 15-Oct-2026 18:55 UTC

CWE: CWE-349
Product: nuxt-og-image
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-15 20:29:51.189323+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-15 18:53:01.928580+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-102527.html