Nuxt dev server arbitrary file read through client error reports
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.6.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Nuxt web development framework's development server is affected, specifically versions in the 4.6 release line before the fix. A client that can reach an exposed development server over the network can trick it into reading arbitrary files on the host machine and returning their contents, which can expose sensitive data such as credentials or source code.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- nuxt nuxt
From 4.6.0 · fixed in 4.6.3