Skip to content
OpenAdvisories

Package · npm

@nuxt/devtools

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.6
    CVE-2026-71319

    Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

    Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authen…

    nuxt devtools @nuxt/devtools npm
  • Medium 6.9
    CVE-2025-52662

    Nuxt DevTools vulnerable to cross-site scripting (XSS)

    A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-…

    vercel Nuxt Devtools @nuxt/devtools npm
  • High 8.8
    CVE-2024-23657

    Path Traversal: '../filedir' in Nuxt Devtools

    Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the `getTextAssetContent` RPC function which is vulnerable to path traversal. Combined with a lack of Origin ch…

    nuxt nuxt @nuxt/devtools npm