Code Injection

nuxt is vulnerable to Code Injection. The vulnerability exists due to a lack of user input path validation in test-component-wrapper.ts which allows an attacker to inject and execute malicious code. Note that this vulnerability is only applicable if the server is ran on dev mode...

nuxt Code Injection vulnerability

he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly...

@neutron.co.id/pemasaran-modules (>=1.1.1-beta.3, <=1.4.0), nuxt-hydration (>=0.0.1, <=0.1.0) potentially affected by CVE-2023-3224 via nuxt (3.4.2)

nuxt NPM version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt and may be impacted: - @neutron.co.id/pemasaran-modules =1.1.1-beta.3, =0.0.1, =0.1.0 Source cves: CVE-2023-3224 Source advisory: OSV:GHSA-GC34-5V43-H7V8...

GHSA-GC34-5V43-H7V8 nuxt Code Injection vulnerability

he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly...

@neutron.co.id/pemasaran-modules (>=1.1.1-beta.3, <=1.4.0), nuxt-hydration (>=0.0.1, <=0.1.0) potentially affected by CVE-2023-3224 via nuxt (3.4.2)

nuxt NPM version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt and may be impacted: - @neutron.co.id/pemasaran-modules =1.1.1-beta.3, =0.0.1, =0.1.0 Source cves: CVE-2023-3224 Source advisory: GHSA-GC34-5V43-H7V8...

CVE-2023-3224

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-3224

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

Nuxt code injection vulnerability

Nuxt.js is an open source web application framework based on Vue.js, Node.js, Webpack and Babel.js. A code injection vulnerability exists in versions prior to nuxt 3.5.3. An attacker exploits this vulnerability to perform a code injection attack...

CVE-2023-3224

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-3224: Improper Control of Generation of Code

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

@neutron.co.id/pemasaran-modules (>=1.1.1-beta.3, <=1.4.0), nuxt-hydration (>=0.0.1, <=0.1.0) potentially affected by CVE-2023-3224 via nuxt (3.4.2)

nuxt NPM version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt and may be impacted: - @neutron.co.id/pemasaran-modules =1.1.1-beta.3, =0.0.1, =0.1.0 Source cves: CVE-2023-3224 Source advisory: MEND:CVE-2023-3224...

CVE-2023-3224 Code Injection in nuxt/nuxt

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-3224 Code Injection in nuxt/nuxt

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

CVE-2023-3224 Code Injection in nuxt/nuxt

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3...

PT-2023-23680 · Nuxt · Nuxt

Name of the Vulnerable Software and Affected Versions: nuxt versions prior to 3.5.3 nuxt versions 3.4.0 through 3.4.3 Description: The issue concerns code injection in the Nuxt dev server. When the dev server is exposed publicly, it is vulnerable to code injection. This affects versions of nuxt...

CVE-2023-3224

CVE-2023-3224 corresponds to a code injection vulnerability in the Nuxt.js/Nuxt repository prior to 3.5.3. Affected product: Nuxt.js (nuxt/nuxt) before 3.5.3; root cause indicated as code injection via the dev server. Impact per sources: high/critical severity with high confidentiality/integrity/...

RCE in developer mode

Description Nuxt contains a test-component-wrapper component. This is used to mount a single component for testing. This component has a dynamic import function which accepts arbitrary user input on the server side. This pattern will almost always lead to an RCE bug. Requirements & Notes The serv...

(Almost) Arbitary File Read on Development Server

Description I previously disclosed an arbitrary file read due to Vite misconfiguration. This is a similar vulnerability with less impact. Proof of Concept Start any nuxt app in dev. Browse to: + http://localhost:3000/\nuxtvitenode\/module/C:/Windows/System32/calc.exe +...

@nuxtlabs/github-module made Use of Hard-coded Credentials

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes GitHub organizations. A patch in version 1.6.2 fixed the issue...

GHSA-FP2W-G92G-FGQ4 @nuxtlabs/github-module made Use of Hard-coded Credentials

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes GitHub organizations. A patch in version 1.6.2 fixed the issue...