Nuxt Devtools has a Path Traversal: '../filedir

Description

Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability.

Recommendation

Update the @nuxt/devtools package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.9
• Patched version(s): 1.3.9

References

• GHSA-rcvg-rgf7-pppv
• portswigger.net
• CVE-2024-23657
• CWE-22
• CWE-24
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• mongosh vulnerable to local privilege escalation - CVE-2025-1756
• Elliptic's EDDSA missing signature length check - CVE-2024-42459
• @thi.ng/paths Prototype Pollution vulnerability - CVE-2024-29650
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

@nuxt/devtools