Loading story…
A critical remote code execution flaw tracked as CVE-2026-71319 was disclosed in Nuxt DevTools versions prior to 3.3.1, where the nuxt:devtools:rpc plugin exposed an unauthenticated bidirectional RPC channel over the Vite HMR WebSocket in development mode. Because the channel lacked a token requirement, handshake, and origin validation, any reachable client could invoke RPC methods remotely. Attackers could abuse updateOptions() to set behavior.openInEditor to an arbitrary command and then trigger openInEditor() to execute that command on the developer’s machine, making the issue remotely exploitable with a reported CVSS 9.6 severity.
Nuxt addressed the issue in DevTools 3.3.1 by adding developer-auth token enforcement to previously unauthenticated mutating RPC actions, including operations that persist settings, clear options, and open files in an editor. The fix also updated the client UI to obtain authentication before settings changes and added unit tests to ensure invalid tokens are rejected before side effects occur. Organizations using Nuxt DevTools were advised to upgrade to 3.3.1 or later and ensure the HMR WebSocket is not exposed externally.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-71319 was published as a critical remote code execution vulnerability in Nuxt DevTools affecting versions before 3.3.1. The advisory states that an unauthenticated RPC channel over the Vite HMR WebSocket could be abused to execute arbitrary commands on a developer machine and notes that the issue is fixed in version 3.3.1.
A Nuxt DevTools code change introduced developer-auth token enforcement for the previously unauthenticated updateOptions, clearOptions, and openInEditor RPC methods, and added unit tests covering token validation. This commit is the referenced fix for the vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security disclosures detailed two development-server flaws that exposed sensitive local project information over network-accessible endpoints. In Nuxt, the route `/.well-known/appspecific/com.chrome.devtools.json` returned workspace metadata, including project configuration, a workspace UUID, and the absolute project root directory, without authorization checks. The issue was fixed in pull request `#35201` by adding an `isLocalDevRequest` check that validates headers such as `Host`, `Sec-Fetch-Site`, `Origin`, and `Referer`, returning `403 Forbidden` for disallowed requests; the advisory also noted a limitation affecting some IPv6 localhost requests with ports. A separate advisory warned that Vitest Browser Mode could expose enough browser-runner data to let remote attackers authenticate to the API, proxy raw Chrome DevTools Protocol commands through `cdp()`, overwrite `vite.config.ts`, and execute attacker-controlled Node.js code on the host even when `allowWrite` and `allowExec` were disabled. The attack was possible when the Browser Mode API server was exposed to the network, such as: ```bash --browser.api.host=0.0.0.0 ``` and could also be used to run JavaScript in the browser session and probe local files via `file://` navigation, turning development tooling exposure into a high-impact confidentiality and code-execution risk.
Jun 29, 2026
A critical flaw tracked as **`CVE-2026-71320`** allows remote code execution in the Nuxt framework by abusing server island props passed to the ` /__nuxt_island/ ` endpoint when **`vue.runtimeCompiler: true`** is enabled. The bug affects **Nuxt 3.4.0 through before 3.21.10** and **Nuxt 4.0.0 through before 4.5.1**, where attacker-controlled properties from query strings or request bodies could reach the server-side rendering pipeline and inject a dangerous `template` key into dynamic Vue components, leading to template execution inside the Nitro process. The issue is classified under **`CWE-94`** and **`CWE-74`** and carries a high-impact CVSS vector of **`AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`**. Nuxt has released fixes in **3.21.10** and **4.5.1** that add deep validation for unsafe island props and reject malicious requests with **HTTP 400** when the runtime compiler is active. The patch introduces a traversal check for the `template` key before props are forwarded into SSR, closing the documented attack path involving dynamic components such as ` <component :is> `. Researchers noted a residual theoretical concern that the validation relies on `Object.keys()` and could be bypassed in a separate prototype-pollution scenario, but the primary mitigation is available now and defenders are also advised to disable **`vue.runtimeCompiler`** in `nuxt.config.ts` where it is not required.
Aug 6, 2026
A critical remote code execution vulnerability, **CVE-2026-53633**, was disclosed in Vitest Browser Mode after researchers found that the exposed `cdp()` API could forward raw Chrome DevTools Protocol requests without properly enforcing `allowWrite` or `allowExec` restrictions. An attacker with access to exposed browser API metadata could abuse methods such as `Page.setDownloadBehavior` and `Runtime.evaluate` to overwrite `vite.config.ts` and run attacker-controlled Node.js code, making the issue remotely exploitable and earning a **CVSS 9.8** rating. The flaw affects Vitest versions `3.0.0` through before `3.2.5`, `4.0.0` through before `4.1.8`, and `5.0.0-beta.0` through before `5.0.0-beta.4`. Maintainers addressed the issue in release `3.2.5` by adding `allowWrite` and `allowExec` options and disabling the client CDP API when those settings are false; corresponding fixes are also available in versions `4.1.8` and `5.0.0-beta.4`. Organizations using Vitest Browser Mode should upgrade to the patched releases and review whether browser-facing API metadata is exposed in reachable environments.
Jul 15, 2026