Vulnerability · Published Jan 25, 2025 · Assigned by GitHub_M

CVE-2025-24361Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Medium 5.3

In plain English

A medium-severity security flaw in nuxt from nuxt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 72.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@nuxt/rspack-builder	3.15.3	GHSA-4gf7-ff8x-hq99
npm	@nuxt/webpack-builder	3.15.3	GHSA-4gf7-ff8x-hq99

Affected products (as reported)

Vendor	Product	Versions
nuxt	nuxt	>= 3.0.0, < 3.15.3>= 3.12.2, < 3.15.3

Weakness: CWE-749 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99 x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f x_refsource_MISC