Go to packages list

nuxt-devtools

Ecosystem: npm

Downloads: 10.12 Mln

Vulnerabilities from the last (months)
  • 1CriticalAffects 1 version
  • 1HighAffects 1 version
  • 0MediumAffects 0 versions
  • 1ModerateAffects 1 version
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical1 (33.3%)
  • High1 (33.3%)
  • Medium0 (0.0%)
  • Moderate1 (33.3%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 1
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting nuxt-devtools, based on data from OSV.

Vulnerabilities affecting nuxt-devtools
IDSeveritySummaryAffected versionsPublishedSource
GHSA-279x-mwfv-vcqvCriticalUnauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host### Impact Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the `nuxt:devtools:rpc` plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (`ws://<host>:<port>/`, subprotocol `vite-hmr`) can call RPC methods, with no token, handshake, or origin check before the channel is established. The `updateOptions()`, `clearOptions()`, and `openInEditor()` methods do not enforce the `ensureDevAuthToken` check that the other mutating methods use. `openInEditor()` reads the persisted `behavio
  • < 3.3.1
GitHub (opens in a new tab)
GHSA-xmq3-q5pm-rp26ModerateNuxt DevTools vulnerable to cross-site scripting (XSS)A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.
  • < 2.6.4
GitHub (opens in a new tab)
GHSA-rcvg-rgf7-pppvHighNuxt Devtools has a Path Traversal: '../filedir'### Summary Nuxt Devtools is missing authentication on the `getTextAssetContent` RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability. In certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE. ### Details The `getTextAssetContent` function does not check for path traversals [(source)](https://github.com/nuxt/devtools/blob/c4f2b682812
  • < 1.3.9
GitHub (opens in a new tab)
  • GHSA-279x-mwfv-vcqvCritical
    Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
    • < 3.3.1
    GitHub (opens in a new tab)

    ### Impact Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the `nuxt:devtools:rpc` plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (`ws://<host>:<port>/`, subprotocol `vite-hmr`) can call RPC methods, with no token, handshake, or origin check before the channel is established. The `updateOptions()`, `clearOptions()`, and `openInEditor()` methods do not enforce the `ensureDevAuthToken` check that the other mutating methods use. `openInEditor()` reads the persisted `behavio

    CVE: CVE-2026-71319

  • GHSA-xmq3-q5pm-rp26Moderate
    Nuxt DevTools vulnerable to cross-site scripting (XSS)
    • < 2.6.4
    GitHub (opens in a new tab)

    A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.

    CVE: CVE-2025-52662

  • GHSA-rcvg-rgf7-pppvHigh
    Nuxt Devtools has a Path Traversal: '../filedir'
    • < 1.3.9
    GitHub (opens in a new tab)

    ### Summary Nuxt Devtools is missing authentication on the `getTextAssetContent` RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability. In certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE. ### Details The `getTextAssetContent` function does not check for path traversals [(source)](https://github.com/nuxt/devtools/blob/c4f2b682812

    CVE: CVE-2024-23657

Showing 1-3 of 3 vulnerabilities