Vulnerability · Published Jan 25, 2025 · Assigned by GitHub_M

CVE-2025-24360Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Medium 5.3

In plain English

A medium-severity information exposure in nuxt from nuxt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.6%top 53.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@nuxt/vite-builder	3.15.3	GHSA-2452-6xj8-jh47

Affected products (as reported)

Vendor	Product	Versions
nuxt	nuxt	>= 3.8.1, < 3.15.3

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47 x_refsource_CONFIRM
https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6 x_refsource_MISC
https://github.com/nuxt/nuxt/pull/23995 x_refsource_MISC
https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f x_refsource_MISC
https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263 x_refsource_MISC
https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39 x_refsource_MISC