Remote Code Execution

nuxt is vulnerable to Remote Code Execution. The vulnerability is due to insufficient validation of the path parameter in the NuxtTestComponentWrapper, which allows an attacker to execute arbitrary JavaScript on the server side. Attackers can exploit this vulnerability by creating a malicious web...

Server-Side Request Forgery

@nuxt/icon is vulnerable to Server-Side Request Forgery. The vulnerability is due to improperly parsed proxied request paths in the /api/nuxticon/name endpoint, which lets an attacker change the scheme and host of the request. An attackers can exploit this flaw by passing a path prefixed with...

Cross-Site Scripting (XSS)

nuxt is vulnerable to a Cross-site Scripting XSS. nuxt is vulnerable to a Cross-site Scripting XSS. The vulnerability is due to improper handling of the javascript: protocol in the navigateTo function, which fails to correctly parse and block malformed URLs due to improper usage of the unjs/ufo...

CVE-2024-34343

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The navigateTo function attempts to blockthe javascript: protocol, but does not correctly use API's provided by unjs/ufo. This library also contains parsing discrepancies. The function first...

CVE-2024-42352

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...

CVE-2024-34344

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the path parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrar...

CVE-2024-23657

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attack...

CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...

CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...

CVE-2024-42352

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. "nuxt/icon" provides an API to allow client side icon lookup. This endpoint is at "/api/nuxticon/name". The proxied request path is improperly parsed, allowing an attacker to change the scheme...

CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...

CVE-2024-42352

CVE-2024-42352 concerns the Nuxt icon API exposed at /api/_nuxt_icon/[name]. The issue stems from how the proxied request path is parsed, allowing an attacker to change the scheme and host of the request via the new URL constructor, which tolerates poorly formatted URLs. This can enable SSRF, pot...

@bloggrify/bento (>=0.9.1, <=0.9.4), @bloggrify/core (>=1.1.1, <=1.4.5) +26 more potentially affected by CVE-2024-34344 via nuxt (>=3.4.2, <=3.12.3)

nuxt NPM version =3.4.2, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =4.0.3, =0.1.0, =0.0.1, =0.0.1, =0.5.0, =1.1.1-beta.3, =1.4.1-alpha.13, =1.0.1-alpha.1024, =1.4.0 and more Source cves: CVE-2024-34344 Source advisory: MEND:CVE-2024-34344...

CVE-2024-34344 Remote code execution via the browser when running the test locally in nuxt

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the path parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrar...

CVE-2024-34344

Nuxt contains a server-side RCE due to insufficient validation of the path parameter in NuxtTestComponentWrapper, enabling arbitrary JavaScript execution on the server when a user loads a malicious page while testing locally. Affected versions include Nuxt 3.4.0 through versions prior to 3.12.4 (...

CVE-2024-34344

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the "path" parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute...

CVE-2024-34344 Remote code execution via the browser when running the test locally in nuxt

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the path parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrar...

CVE-2024-34343

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The "navigateTo" function attempts to blockthe "javascript:" protocol, but does not correctly use API's provided by "unjs/ufo". This library also contains parsing discrepancies. The function...

CVE-2024-34343 Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The navigateTo function attempts to blockthe javascript: protocol, but does not correctly use API's provided by unjs/ufo. This library also contains parsing discrepancies. The function first...

CVE-2024-34343 Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The navigateTo function attempts to blockthe javascript: protocol, but does not correctly use API's provided by unjs/ufo. This library also contains parsing discrepancies. The function first...