Opening a malicious website while running a Nuxt dev server could allow read-only access to code
- Severity:
- Medium
Description
Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site.
Recommendation
Update the @nuxt/rspack-builder package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.12.2, < 3.15.3
- Patched version(s): 3.15.3
References
Related Issues
- x402 SDK vulnerable in outdated versions in resource servers for builders (GHSA-3j63-5h8p-gf7c) 3 - Vulnerability
- Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548
- jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label - CVE-2022-31160
- vue-i18n has cross-site scripting vulnerability with prototype pollution (GHSA-9r9m-ffp6-9x4v) 4 - CVE-2024-52809
- Tags:
- npm
- @nuxt/rspack-builder
Anything's wrong? Let us know Last updated on January 27, 2025