Description
A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.
Recommendation
Update the @nuxt/devtools package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.6.4
- Patched version(s): 2.6.4
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt DevTools vulnerable to cross-site scripting (XSS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
- @tiptap/extension-link vulnerable to Cross-site Scripting (XSS) - CVE-2025-14284
- @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params - CVE-2025-32388
- Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - vega-interpreter - CVE-2025-59840
You might also like:
See something that needs correcting? Let us knowUpdated November 07, 2025