CVE-2026-71319

Nuxt DevTools prior to version 3.3.1 exposes an unauthenticated bidirectional RPC channel over the Vite HMR WebSocket (ws://:/, subprotocol vite-hmr). The channel, via plugin nuxt:devtools:rpc, allows calling RPC methods without token/handshake/origin checks; updateOptions(), clearOptions(), and ...

EUVD-2008-5361

Malware in sbrugna...

Cross-Site Request Forgery (CSRF)

react-dev-utils is vulnerable to cross-site request forgery. Local unauthenticated attackers could exploit the flawed Webserver component to execute arbitrary commands on the targeted system via the unsanitized input command to launch an editor...