BaseFortify

Publication date: 2025-11-07

Last updated on: 2026-02-04

Assigner: HackerOne

Description

A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-07

Last Modified

2026-02-04

Generated

2026-07-06

AI Q&A

2025-11-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-52662

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt	devtools	to 2.6.4 (inc)
nuxt	devtools	2.6.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in Nuxt DevTools allowed extraction of Nuxt authentication tokens via cross-site scripting (XSS) under certain configurations. It was fixed in version 2.6.4, and users are encouraged to upgrade to prevent this issue.

Impact Analysis

The vulnerability could allow attackers to steal authentication tokens through XSS, potentially leading to unauthorized access or impersonation within applications using Nuxt DevTools.

Mitigation Strategies

Upgrade Nuxt DevTools to version 2.6.4 or later to fix the vulnerability that may allow Nuxt auth token extraction via XSS.

Hi! I’m here to help you understand CVE-2025-52662. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70