CVE-2026-71320: Nuxt Server Island Template Injection Leads to Server-Side RCE

CVE-2026-71320 lets an attacker inject a template key into Nuxt server island props and have Vue's runtime compiler execute it inside the Nitro process - server-side RCE, CVSS 8.1. Three preconditions must all hold, and the third one, attribute fallthrough onto a polymorphic root component, is the part that catches people out. A walkthrough of the real mechanism verified against the upstream…