Nuxt Devtools has a Path Traversal: '../filedir

Description

Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability.

Recommendation

Update the @nuxt/devtools package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.9
• Patched version(s): 1.3.9

References

• GHSA-rcvg-rgf7-pppv
• portswigger.net
• CVE-2024-23657
• CWE-22
• CWE-24
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal - CVE-2024-50336
• Agnai vulnerable to Relative Path Traversal in Image Upload - CVE-2024-47171
• Agnai File Disclosure Vulnerability: JSON via Path Traversal - CVE-2024-47170
• Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@nuxt/devtools