nuxt Code Injection vulnerability

Description

he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly.

Recommendation

Update the nuxt package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.4.0, < 3.4.3
• Patched version(s): 3.4.3

References

• GHSA-gc34-5v43-h7v8
• huntr.dev
• CVE-2023-3224
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• FUXA SQL Injection vulnerability - fuxa-server - CVE-2023-31719
• FUXA SQL Injection vulnerability - CVE-2023-31717
• squirrelly Code Injection vulnerability - CVE-2024-40453
• CouchAuth host header injection vulnerability leaks the password reset token - CVE-2023-39655

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Exploiting Server Version Disclosure

Tags:

npm

nuxt