Code Injection

nuxt is vulnerable to Code Injection. The vulnerability exists due to a lack of user input path validation in test-component-wrapper.ts which allows an attacker to inject and execute malicious code. Note that this vulnerability is only applicable if the server is ran on dev mode...

@neutron.co.id/pemasaran-modules (>=1.1.1-beta.3, <=1.4.0), nuxt-hydration (>=0.0.1, <=0.1.0) potentially affected by CVE-2023-3224 via nuxt (3.4.2)

nuxt NPM version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt and may be impacted: - @neutron.co.id/pemasaran-modules =1.1.1-beta.3, =0.0.1, =0.1.0 Source cves: CVE-2023-3224 Source advisory: OSV:GHSA-GC34-5V43-H7V8...

nuxt Code Injection vulnerability

he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly...

GHSA-GC34-5V43-H7V8 nuxt Code Injection vulnerability

he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly...

CVE-2023-3224

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-3224

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-3224 Code Injection in nuxt/nuxt

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

PT-2023-23680 · Nuxt · Nuxt

Name of the Vulnerable Software and Affected Versions: nuxt versions prior to 3.5.3 nuxt versions 3.4.0 through 3.4.3 Description: The issue concerns code injection in the Nuxt dev server. When the dev server is exposed publicly, it is vulnerable to code injection. This affects versions of nuxt...

CVE-2023-3224 Code Injection in nuxt/nuxt

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-3224

CVE-2023-3224 corresponds to a code injection vulnerability in the Nuxt.js/Nuxt repository prior to 3.5.3. Affected product: Nuxt.js (nuxt/nuxt) before 3.5.3; root cause indicated as code injection via the dev server. Impact per sources: high/critical severity with high confidentiality/integrity/...

nuxt 代码注入漏洞

Nuxt.js is an open source web application framework based on Vue.js, Node.js, Webpack and Babel.js. A code injection vulnerability exists in versions prior to nuxt 3.5.3. An attacker exploits this vulnerability to perform a code injection attack...

CVE-2023-3224 Code Injection in nuxt/nuxt

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

RCE in developer mode

Description Nuxt contains a test-component-wrapper component. This is used to mount a single component for testing. This component has a dynamic import function which accepts arbitrary user input on the server side. This pattern will almost always lead to an RCE bug. Requirements & Notes The serv...

(Almost) Arbitary File Read on Development Server

Description I previously disclosed an arbitrary file read due to Vite misconfiguration. This is a similar vulnerability with less impact. Proof of Concept Start any nuxt app in dev. Browse to: + http://localhost:3000/\nuxtvitenode\/module/C:/Windows/System32/calc.exe +...

@nuxtlabs/github-module made Use of Hard-coded Credentials

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes GitHub organizations. A patch in version 1.6.2 fixed the issue...

GHSA-FP2W-G92G-FGQ4 @nuxtlabs/github-module made Use of Hard-coded Credentials

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes GitHub organizations. A patch in version 1.6.2 fixed the issue...

Github token with wide access to Nuxt related repositories leaked in the wild

Description If you visit https://nuxt.com, you will find hardcoded Github token in the source code of the page - ghpYXegsf40mjoFZMPSdntLbrGIBRZYKf0i2FoK. This token has access to multiple repositories under nuxt , nuxtlabs and nuxt-themes Github organisations. https://github.com/nuxt Admin...

Cross-site Scripting (XSS)

nuxt is vulnerable to cross-site scriptingXSS attacks. The vulnerability is due to prerendered sites, allowing an attacker to pass a specifically crafted URL through the getPayloadURL function and execute harmful JavaScript on the target system...

CVE-2023-0878

Cross-site Scripting XSS - Generic in GitHub repository nuxt/framework prior to 3.2.1...

PT-2023-16582 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to 3.2.1 Description: The issue is related to Cross-site Scripting XSS - Generic. This is a type of security vulnerability that occurs when an application includes user input in its output without proper validati...