EUVD-2025-178263

Malicious code in joviology-nuxtjs-ursa-lacerta npm...

EUVD-2025-176357

Malicious code in sirius-nuxtjs-genomics-hydrogeology npm...

EUVD-2025-120766

Malicious code in virgo-nuxtjs-achernar-spectron-webdriver npm...

EUVD-2025-121716

Malicious code in spinner-semantic-release-nuxtjs-polaris npm...

EUVD-2025-124614

Malicious code in nconf-ceres-css-minimizer-webpack-plugin-nuxtjs npm...

EUVD-2025-124257

Malicious code in nova-postcss-loader-nuxtjs-duplex npm...

EUVD-2025-123994

Malicious code in package-dactyl-callisto-nuxtjs npm...

MAL-2025-141694 Malicious code in dorado-nuxtjs-procyon-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b925d25988baf7e067d0e986f7a02f01e3109348b252ff402f07ac839ce6c6cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113424

Malicious code in framework-nuxtjs-sedna-build npm...

CVE-2025-52662

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools...

GHSA-XMQ3-Q5PM-RP26 Nuxt DevTools vulnerable to cross-site scripting (XSS)

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade...

@dargmuesli/nuxt-vio (>=16.0.5, <=18.3.14) potentially affected by CVE-2025-52662 via @nuxt/devtools (>=2.0.0, <=2.6.3)

@nuxt/devtools NPM version =2.0.0, =16.0.5, =18.3.14 Source cves: CVE-2025-52662 Source advisory: OSV:GHSA-XMQ3-Q5PM-RP26...

EUVD-2025-38187

Nuxt DevTools vulnerable to cross-site scripting XSS...

Nuxt DevTools vulnerable to cross-site scripting (XSS)

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade...

Cross-site Scripting (XSS)

Overview @nuxt/devtools is a Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of error messages on DevTools authentication page. An attacker can extract authentication tokens by tricking a user into interacting with maliciously crafted...

@dargmuesli/nuxt-vio (>=16.0.5, <=18.3.14) potentially affected by CVE-2025-52662 via @nuxt/devtools (>=2.0.0, <=2.6.3)

@nuxt/devtools NPM version =2.0.0, =16.0.5, =18.3.14 Source cves: CVE-2025-52662 Source advisory: SNYK:JS-NUXTDEVTOOLS-13849298...

CVE-2025-52662

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools...

CVE-2025-52662

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools...

CVE-2025-52662

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools...

CVE-2025-52662

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools...