nuxt Code Injection vulnerability

Description

he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly.

Recommendation

Update the nuxt package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.4.0, < 3.4.3
• Patched version(s): 3.4.3

References

• GHSA-gc34-5v43-h7v8
• huntr.dev
• CVE-2023-3224
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• gatsby-transformer-remark has possible unsanitized JavaScript code injection - CVE-2023-22491
• CouchAuth host header injection vulnerability leaks the password reset token - CVE-2023-39655
• chromedriver Command Injection vulnerability - CVE-2023-26156
• squirrelly Code Injection vulnerability - CVE-2024-40453

Tags:

npm

nuxt