PT-2026-70157

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettin...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettings is enabled. An attacker can obtain the absolute project...

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint vulnerability discovered by ? in WordPress Npm nuxt versions = 3.21.7, 3.21.10...

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

GHSA-7C4V-FWGW-9RF7 Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

Information Exposure

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettings is enabled. An attacker can...

[SECURITY] Fedora 44 Update: gst-devtools-1.28.6-1.fc44

Development and debugging tools for GStreamer...

Malicious code in golaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...

MAL-2026-13392 Malicious code in golaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...

CVE-2026-71319

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

GHSA-279X-MWFV-VCQV Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Impact Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint ws://:/, subprotocol vite-hmr can call RPC methods,...

@dargmuesli/nuxt-vio (>=18.3.17, <=22.0.0-beta.5) potentially affected by CVE-2026-71319 via @nuxt/devtools (>=3.0.0, <=3.2.4)

@nuxt/devtools NPM version =3.0.0, =18.3.17, =22.0.0-beta.5 Source cves: CVE-2026-71319 Source advisory: SNYK:JS-NUXTDEVTOOLS-18565128...

@dargmuesli/nuxt-vio (>=18.3.17, <=22.0.0-beta.5) potentially affected by CVE-2026-71319 via @nuxt/devtools (>=3.0.0, <=3.2.4)

@nuxt/devtools NPM version =3.0.0, =18.3.17, =22.0.0-beta.5 Source cves: CVE-2026-71319 Source advisory: GHSA-279X-MWFV-VCQV...

Missing Authentication for Critical Function

Overview @nuxt/devtools is a Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the nuxt:devtools:rpc. An attacker can execute arbitrary commands on the host system by sending crafted RPC calls to the exposed WebSocket endpoint without...

@dargmuesli/nuxt-vio (>=18.3.17, <=22.0.0-beta.5) potentially affected by CVE-2026-71319 via @nuxt/devtools (>=3.0.0, <=3.2.4)

@nuxt/devtools NPM version =3.0.0, =18.3.17, =22.0.0-beta.5 Source cves: CVE-2026-71319 Source advisory: OSV:GHSA-279X-MWFV-VCQV...

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Impact Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint ws://:/, subprotocol vite-hmr can call RPC methods,...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @aneoconsultingfr/armonik-docs-theme (>=0.6.4, <=0.6.15) +78 more potentially affected by CVE-2026-71319 via @nuxt/devtools (>=0.1.6, <=3.2.4)

@nuxt/devtools NPM version =0.1.6, =1.0.1, =0.6.4, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.0.3, =0.0.4, =1.0.0-29304822.f444f03, =8.3.3, =1.1.1, =0.0.1, =0.1.6 and more Source cves: CVE-2026-71319 Source advisory: MEND:CVE-2026-71319...

CVE-2026-71319 Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

EUVD-2026-53648

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...