GHSA-82FW-GWWQ-J7X9 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Summary @vitest/mocker registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the...

CVE-2026-71319

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

GHSA-279X-MWFV-VCQV Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Impact Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint ws://:/, subprotocol vite-hmr can call RPC methods,...

CVE-2026-71319 Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

PT-2026-68338

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 3.3.1 Description Nuxt DevTools, when used in development mode, exposes a bidirectional RPC Remote Procedure Call channel over the Vite HMR Hot Module Replacement WebSocket via the nuxt:devtools:rpc plugin. This channel...

CVE-2026-71319: Improper Control of Generation of Code

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...