Nuxt Devtools has a Path Traversal: '../filedir

Description

Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability.

Recommendation

Update the @nuxt/devtools package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.9
• Patched version(s): 1.3.9

References

• GHSA-rcvg-rgf7-pppv
• portswigger.net
• CVE-2024-23657
• CWE-22
• CWE-24
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal - CVE-2024-50336
• Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414
• Langchain Path Traversal vulnerability - CVE-2024-7774
• jsPDF has Local File Inclusion/Path Traversal vulnerability - CVE-2025-68428

Tags:

npm

@nuxt/devtools