CVE-2026-71319 Details
Description
Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://<host>:<port>/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use. openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '<command>' }) then openInEditor('<any-existing-file>') to execute an arbitrary program on the developer's machine. This issue is fixed in 3.3.1.
A vulnerability in Nuxt DevTools prior to version 3.3.1 allows for unauthorized execution of commands on a developer's machine. This issue arises from a bidirectional RPC channel exposed over the Vite Hot Module Replacement (HMR) WebSocket, without any authentication. Any client that can access the Vite HMR endpoint can invoke RPC methods without a token or origin check. The vulnerability is present in development mode only, as production builds do not include DevTools. Exploitation requires access to the HMR port, which can be achieved through various means, including local processes, LAN peers, or malicious websites.
Update Nuxt DevTools to version 3.3.1 or later. If using Nuxt, a lockfile refresh or reinstall is required, as Nuxt depends on '@nuxt/devtools' within a '^3.x' range.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4 | [email protected] | Source CodeVendor |
| https://github.com/nuxt/devtools/releases/tag/v3.3.1 | [email protected] | Release NotesVendor |
| https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nuxt | All versions |
CPE
Remediation
| |
| Nuxt DevTools | < 3.3.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |