{"id":"EUVD-2025-38187","enisaUuid":"7e5aa612-91b8-3037-a211-bcb36664f30f","description":"A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.\r\n\r\nMore details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools","datePublished":"Nov 7, 2025, 12:43:27 AM","dateUpdated":"Dec 1, 2025, 8:12:06 PM","baseScore":6.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N","references":"https://github.com/nuxt/devtools/commit/7cadbbe9\nhttps://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools\n","aliases":"CVE-2025-52662\nGHSA-xmq3-q5pm-rp26\n","assigner":"hackerone","epss":0.25,"enisaIdProduct":[{"id":"0e0f3fe7-aab9-333b-8ed2-7565362a3eb4","product":{"name":"Nuxt Devtools","vendor":{"name":"vercel"}},"product_version":"2.6.3 ≤2.6.3"}],"enisaIdVendor":[{"id":"ea0c6f65-44fd-30d9-9ceb-efeab03ddf18","vendor":{"name":"vercel"}}],"enisaIdVulnerability":[{"id":"3354731b-fd01-32e3-ad84-dce99dbb3485","vulnerability":{"id":"CVE-2025-52662","description":"A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.\r\n\r\nMore details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools","datePublished":"Nov 7, 2025, 12:43:27 AM","dateUpdated":"Dec 1, 2025, 8:12:06 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N","references":"https://github.com/nuxt/devtools/commit/7cadbbe9\nhttps://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools\n","enisa_id":"EUVD-2025-38187\n","assigner":"hackerone","epss":0.25,"dataProcessed":"Nov 1, 2026, 1:38:03 AM","vulnerabilityProduct":[{"id":"2b589cdc-6cd4-35aa-8896-3976682488ac","product":{"name":"Nuxt Devtools","vendor":{"name":"vercel"}},"product_version":"2.6.3 ≤2.6.3"}],"vulnerabilityVendor":[{"id":"c619bf86-94bd-36ed-a0ba-81e0c69a2449","vendor":{"name":"vercel"}}]}},{"id":"419f6cc9-946c-3d42-b66d-e3e02f033e32","vulnerability":{"id":"GHSA-xmq3-q5pm-rp26","description":"Nuxt DevTools vulnerable to cross-site scripting (XSS)","datePublished":"Nov 7, 2025, 3:30:25 AM","dateUpdated":"Nov 7, 2025, 5:41:22 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-52662\nhttps://github.com/nuxt/devtools/commit/7cadbbe9\nhttps://github.com/nuxt/devtools\nhttps://github.com/nuxt/devtools/releases/tag/v2.6.4\nhttps://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools\n","enisa_id":"EUVD-2025-38187\n","aliases":"GHSA-xmq3-q5pm-rp26\nCVE-2025-52662\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}