{"id":"GHSA-279x-mwfv-vcqv","revision":"c9f27f1ae4554075b713d606fa4455d4","records":[{"revision":"c9f27f1ae4554075b713d606fa4455d4","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-279x-mwfv-vcqv","aliases":["CVE-2026-71319"],"title":"Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host","description":"### Impact\n\nNuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the `nuxt:devtools:rpc` plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (`ws://<host>:<port>/`, subprotocol `vite-hmr`) can call RPC methods, with no token, handshake, or origin check before the channel is established. The `updateOptions()`, `clearOptions()`, and `openInEditor()` methods do not enforce the `ensureDevAuthToken` check that the other mutating methods use.\n\n`openInEditor()` reads the persisted `behavior.openInEditor` value and passes it to the `launch-editor` package, which spawns it as a child process. That value is settable through the equally unauthenticated `updateOptions()`. An attacker who can reach the HMR port can therefore chain `updateOptions('behavior', { openInEditor: '<command>' })` then `openInEditor('<any-existing-file>')` to execute an arbitrary program on the developer's machine.\n\nThe HMR port is reachable by a process on the same host, by any peer on the LAN when the dev server is bound with `nuxi dev --host`, or by a malicious website the developer visits while the dev server is running (a browser can open the HMR WebSocket cross-origin). Impact is limited to development environments; production builds do not run DevTools.\n\n### Patches\n\nFixed in `@nuxt/devtools@3.3.1`. Because `nuxt` depends on `@nuxt/devtools` through a `^3.x` range, updating is a lockfile refresh / reinstall; no `nuxt` release is required.\n\n### Workarounds\n\n- Update `@nuxt/devtools` to a patched version.\n- Do not run the dev server bound to a non-loopback interface (`nuxi dev --host`) on an untrusted network.\n- Disable DevTools entirely with `devtools: { enabled: false }` in `nuxt.config`.\n\n### References\n\n- GHSA-279x-mwfv-vcqv\n- `launch-editor`: https://www.npmjs.com/package/launch-editor","state":0,"publishedAt":"2026-08-05T21:27:39+00:00","modifiedAt":"2026-08-20T05:15:07.1357726+00:00","affected":[{"ecosystem":"npm","name":"@nuxt/devtools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.3.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv","https://github.com/nuxt/nuxt"],"sourceUrl":"https://github.com/advisories/GHSA-279x-mwfv-vcqv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-279x-mwfv-vcqv","identifiers":["GHSA-279x-mwfv-vcqv","CVE-2026-71319"]},"retained":false,"historicalAffected":[]}],"coverage":[]}