Nuxt Devtools has a Path Traversal: '../filedir

Description

Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability.

Recommendation

Update the @nuxt/devtools package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.9
• Patched version(s): 1.3.9

References

• GHSA-rcvg-rgf7-pppv
• portswigger.net
• CVE-2024-23657
• CWE-22
• CWE-24
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414
• matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal - CVE-2024-50336
• React Router has Path Traversal in File Session Storage (GHSA-9583-h5hc-x8cw) - CVE-2025-61686
• React Router has Path Traversal in File Session Storage - CVE-2025-61686

Tags:

npm

@nuxt/devtools