CVE-2023-3224

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

PT-2023-23680 · Nuxt · Nuxt

Name of the Vulnerable Software and Affected Versions: nuxt versions prior to 3.5.3 nuxt versions 3.4.0 through 3.4.3 Description: The issue concerns code injection in the Nuxt dev server. When the dev server is exposed publicly, it is vulnerable to code injection. This affects versions of nuxt...

CVE-2023-3224 Code Injection in nuxt/nuxt

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-3224 Code Injection in nuxt/nuxt

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

nuxt 代码注入漏洞

Nuxt.js is an open source web application framework based on Vue.js, Node.js, Webpack and Babel.js. A code injection vulnerability exists in versions prior to nuxt 3.5.3. An attacker exploits this vulnerability to perform a code injection attack...

CVE-2023-3224: Improper Control of Generation of Code

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-3224

CVE-2023-3224 corresponds to a code injection vulnerability in the Nuxt.js/Nuxt repository prior to 3.5.3. Affected product: Nuxt.js (nuxt/nuxt) before 3.5.3; root cause indicated as code injection via the dev server. Impact per sources: high/critical severity with high confidentiality/integrity/...

CVE-2023-3224 Code Injection in nuxt/nuxt

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

RCE in developer mode

Description Nuxt contains a test-component-wrapper component. This is used to mount a single component for testing. This component has a dynamic import function which accepts arbitrary user input on the server side. This pattern will almost always lead to an RCE bug. Requirements & Notes The serv...

(Almost) Arbitary File Read on Development Server

Description I previously disclosed an arbitrary file read due to Vite misconfiguration. This is a similar vulnerability with less impact. Proof of Concept Start any nuxt app in dev. Browse to: + http://localhost:3000/\nuxtvitenode\/module/C:/Windows/System32/calc.exe +...

@nuxtlabs/github-module made Use of Hard-coded Credentials

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes GitHub organizations. A patch in version 1.6.2 fixed the issue...

GHSA-FP2W-G92G-FGQ4 @nuxtlabs/github-module made Use of Hard-coded Credentials

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes GitHub organizations. A patch in version 1.6.2 fixed the issue...

Github token with wide access to Nuxt related repositories leaked in the wild

Description If you visit https://nuxt.com, you will find hardcoded Github token in the source code of the page - ghpYXegsf40mjoFZMPSdntLbrGIBRZYKf0i2FoK. This token has access to multiple repositories under nuxt , nuxtlabs and nuxt-themes Github organisations. https://github.com/nuxt Admin...

Cross-site Scripting (XSS)

nuxt is vulnerable to cross-site scriptingXSS attacks. The vulnerability is due to prerendered sites, allowing an attacker to pass a specifically crafted URL through the getPayloadURL function and execute harmful JavaScript on the target system...

CVE-2023-0878

Cross-site Scripting XSS - Generic in GitHub repository nuxt/framework prior to 3.2.1...

PT-2023-16582 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to 3.2.1 Description: The issue is related to Cross-site Scripting XSS - Generic. This is a type of security vulnerability that occurs when an application includes user input in its output without proper validati...

CVE-2023-0878: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Generic in GitHub repository nuxt/framework prior to 3.2.1...

CVE-2023-0878 Cross-site Scripting (XSS) - Generic in nuxt/framework

Cross-site Scripting XSS - Generic in GitHub repository nuxt/framework prior to 3.2.1...

CVE-2023-0878 Cross-site Scripting (XSS) - Generic in nuxt/framework

Cross-site Scripting XSS - Generic in GitHub repository nuxt/framework prior to 3.2.1...

CVE-2023-0878

Summary of CVE-2023-0878 (nuxt/framework). The issue is a Cross-site Scripting (XSS) vulnerability in nuxt/framework prior to 3.2.1, linked to prerendered sites. The root cause centers on how the payload URL is constructed via a function similar to _getPayloadURL, where URL parsing and pathname h...