{"cve":"CVE-2026-71319","nvd":{"published":"2026-08-05T22:17:08.227","modified":"2026-10-24T15:10:00.190","status":"Deferred","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://<host>:<port>/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use. openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '<command>' }) then openInEditor('<any-existing-file>') to execute an arbitrary program on the developer's machine. This issue is fixed in 3.3.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6},"cwes":["CWE-94","CWE-306"],"references":["https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4","https://github.com/nuxt/devtools/releases/tag/v3.3.1","https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:34.184483516+00:00"},"epss":{"cve":"CVE-2026-71319","score":0.00629,"percentile":0.49861,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-279x-mwfv-vcqv","url":"https://osv.dev/vulnerability/GHSA-279x-mwfv-vcqv","summary":"Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host","modified":"2026-08-20T05:15:07.135772644Z","packages":[{"ecosystem":"npm","name":"@nuxt/devtools","purl":"pkg:npm/%40nuxt/devtools","ranges":["<3.3.1"],"fixed":["3.3.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}