{"id":"CVE-2026-71319","aliases":["GHSA-279x-mwfv-vcqv"],"url":"https://o3.security/vulnerability/CVE-2026-71319","summary":"Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution","details":"### Impact\n\nNuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the `nuxt:devtools:rpc` plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (`ws://<host>:<port>/`, subprotocol `vite-hmr`) can call RPC methods, with no token, handshake, or origin check before the channel is established. The `updateOptions()`, `clearOptions()`, and `openInEditor()` methods do not enforce the `ensureDevAuthToken` check that the other mutating methods use.\n\n`openInEditor()` reads the persisted `behavior.openInEditor` value and passes it to the `launch-editor` package, which spawns it as a child process. That value is settable through the equally unauthenticated `updateOptions()`. An attacker who can reach the HMR port can therefore chain `updateOptions('behavior', { openInEditor: '<command>' })` then `openInEditor('<any-existing-file>')` to execute an arbitrary program on the developer's machine.\n\nThe HMR port is reachable by a process on the same host, by any peer on the LAN when the dev server is bound with `nuxi dev --host`, or by a malicious website the developer visits while the dev server is running (a browser can open the HMR WebSocket cross-origin). Impact is limited to development environments; production builds do not run DevTools.\n\n### Patches\n\nFixed in `@nuxt/devtools@3.3.1`. Because `nuxt` depends on `@nuxt/devtools` through a `^3.x` range, updating is a lockfile refresh / reinstall; no `nuxt` release is required.\n\n### Workarounds\n\n- Update `@nuxt/devtools` to a patched version.\n- Do not run the dev server bound to a non-loopback interface (`nuxi dev --host`) on an untrusted network.\n- Disable DevTools entirely with `devtools: { enabled: false }` in `nuxt.config`.\n\n### References\n\n- GHSA-279x-mwfv-vcqv\n- `launch-editor`: https://www.npmjs.com/package/launch-editor","published":"2026-08-05T21:26:59.028Z","modified":"2026-10-28T02:31:02.845491158Z","cvss":{"score":9.6,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},"epss":{"score":0.00356,"percentile":0.28231,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@nuxt/devtools","fixedVersion":"3.3.1"}],"fix":{"url":"https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4","label":"nuxt/devtools@a7b2718"},"references":[{"type":"WEB","url":"https://github.com/nuxt/devtools/releases/tag/v3.3.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71319.json"},{"type":"ADVISORY","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71319"},{"type":"FIX","url":"https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4"},{"type":"PACKAGE","url":"https://github.com/nuxt/nuxt"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:02.845491158Z"}}