CVE-2026-71319

Received Received - Intake

Nuxt DevTools Arbitrary Code Execution via HMR WebSocket

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://<host>:<port>/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use. openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '<command>' }) then openInEditor('<any-existing-file>') to execute an arbitrary program on the developer's machine. This issue is fixed in 3.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-71319

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt	nuxt	to 3.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability affects Nuxt, a Vue.js framework, before version 3.3.1. The Nuxt DevTools development mode exposes an unauthenticated RPC channel over the Vite HMR WebSocket. Attackers can exploit this to call RPC methods without authentication, including executing arbitrary commands on the developer's machine by chaining updateOptions and openInEditor functions.

Detection Guidance

Check if Nuxt DevTools is running on an exposed Vite HMR WebSocket port (default ws://<host>:<port>/ with subprotocol vite-hmr). Verify if the Nuxt version is below 3.3.1. Look for unauthorized RPC method calls or unexpected child process executions.

Impact Analysis

If you use an affected Nuxt version, an attacker within network range could execute arbitrary code on your development machine. This could lead to data theft, malware installation, or further network compromise. The attack requires access to the HMR port (typically ws://host:port/).

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches. Such breaches may violate GDPR (data protection) or HIPAA (health data privacy) requirements, leading to legal penalties, fines, or reputational damage if sensitive data is exposed.

Mitigation Strategies

Upgrade Nuxt to version 3.3.1 or later. Restrict access to the Vite HMR WebSocket port by firewall rules or network segmentation. Disable Nuxt DevTools in production environments.

Hi! I’m here to help you understand CVE-2026-71319. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70