nuxt devtools vulnerabilities

Latest nuxt devtools CVEs

Newest publication first

1. CVE-2026-71319 Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

   Published 2026-08-05

   Critical·CVSS 9.6 EPSS 0.63%

   Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client...

2. CVE-2025-52662 Nuxt DevTools vulnerable to cross-site scripting (XSS)

   Published 2025-11-07

   Medium·CVSS 6.1 EPSS 0.25%

   A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

3. CVE-2024-23657 Path Traversal: '../filedir' in Nuxt Devtools

   Published 2024-08-05

   High·CVSS 8.8 EPSS 1.2%

   Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket h...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.