Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-71319 critical CVSS 9.6

Code Injection in @nuxt/devtools (CVE-2026-71319)

Summary

Code injection in @nuxt/devtools (CVE-2026-71319). Successful exploitation can lead to full system takeover. Exploitable via ensureDevAuthToken. Mitigation: upgrade to 3.3.1 or later.

Original description

The description as published by the source.

Impact

Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://:/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use.

openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '' }) then openInEditor('') to execute an arbitrary program on the developer's machine.

The HMR port is reachable by a process on the same host, by any peer on the LAN when the dev server is bound with nuxi dev --host, or by a malicious website the developer visits while the dev server is running (a browser can open the HMR WebSocket cross-origin). Impact is limited to development environments; production builds do not run DevTools.

Patches

Fixed in @nuxt/devtools@3.3.1. Because nuxt depends on @nuxt/devtools through a ^3.x range, updating is a lockfile refresh / reinstall; no nuxt release is requir…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-71319 has been found in @nuxt/devtools.
Attackers can target a specific entry point like ensureDevAuthToken over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 9.6/10.
What to do: upgrade @nuxt/devtools to 3.3.1 or later.
If unsure, ask your IT team or search "@nuxt/devtools CVE-2026-71319" on the vendor's site.

CVE-2026-71319 (@nuxt/devtools) — CWE-94 / CVSS v3 9.6
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: ensureDevAuthToken / behavior.openInEditor / nuxt / nuxt.config
Patched: 3.3.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Arbitrary code execution (CWE-94) exists in @nuxt/devtools. Attackers reach the vulnerable code path via ensureDevAuthToken without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of @nuxt/devtools. Attack surface: ensureDevAuthToken / behavior.openInEditor / nuxt / nuxt.config.

🔥 Severity

Severity: Critical (CVSS 9.6/10). Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to 3.3.1.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r '@nuxt/devtools' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r '@nuxt/devtools' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で @nuxt/devtools を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade @nuxt/devtools to 3.3.1

    ステージング環境で 3.3.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

npm @nuxt/devtools
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details