A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-52662 · Microsoft / collected KEV context

EUVD-2025-38187

GHSA-xmq3-q5pm-rp26

cve-program · CVE-2025-52662

• https://github.com/nuxt/devtools/commit/7cadbbe9
• https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

euvd · EUVD-2025-38187

• https://github.com/nuxt/devtools/commit/7cadbbe9
• https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

nvd · CVE-2025-52662

• https://github.com/nuxt/devtools/commit/7cadbbe9
• https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

osv · GHSA-xmq3-q5pm-rp26

• https://nvd.nist.gov/vuln/detail/CVE-2025-52662
• https://github.com/nuxt/devtools/commit/7cadbbe9
• https://github.com/nuxt/devtools
• https://github.com/nuxt/devtools/releases/tag/v2.6.4
• https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

No related operational record is retained in the current change model.