Skip to content
Threat Feed
Subscribe
critical advisory

Unauthenticated RCE in Nuxt DevTools via Vite HMR WebSocket

An unauthenticated RPC vulnerability in Nuxt DevTools (CVE-2026-71319) allows local or remote attackers to achieve arbitrary command execution by chaining malicious configuration updates and editor launch commands.

Nuxt DevTools version 3.x prior to 3.3.1 contains a critical vulnerability (CVE-2026-71319) in its RPC mechanism. The DevTools plugin exposes a bidirectional RPC channel over the Vite HMR WebSocket. This channel lacks authentication, meaning any client capable of reaching the HMR endpoint can issue RPC calls without a handshake or origin verification.

The vulnerability exists because specific methods - specifically updateOptions() and openInEditor() - fail to enforce authentication tokens. An attacker can use updateOptions() to modify the editor configuration to contain an arbitrary command. Subsequently, calling openInEditor() triggers the launch-editor package, which executes the attacker-supplied command as a child process. While Nuxt production builds are unaffected, developers running nuxi dev - particularly when bound to non-loopback interfaces or when the developer interacts with a malicious website that initiates a cross-origin WebSocket connection - are at significant risk of local command execution.

Attack Chain

  1. Attacker identifies a developer running Nuxt DevTools on a reachable port (e.g., 3000) via local network or browser-based cross-origin request.
  2. Attacker establishes a WebSocket connection to the Vite HMR endpoint (ws://<host>:<port>/).
  3. Attacker sends a malformed nuxt:devtools:rpc payload to the updateOptions method.
  4. The payload injects a malicious command string into the behavior.openInEditor configuration key within the session memory.
  5. Attacker sends a follow-up RPC call to openInEditor, specifying a file path to trigger the execution logic.
  6. The launch-editor package receives the modified configuration and spawns the malicious command as a child process on the developer's host machine.
  7. Final objective: Achieve arbitrary code execution on the developer's workstation with their current user privileges.

Impact

Successful exploitation results in full remote code execution on the developer's host. This compromises the development environment, potentially allowing the attacker to steal source code, access environment variables, or establish persistent backdoors into the developer's workstation. The scope is limited to development environments, but impacts anyone using affected versions of @nuxt/devtools.

Recommendation

  • Update @nuxt/devtools to version 3.3.1 or higher across all development projects to remediate CVE-2026-71319.
  • Audit existing projects for the use of the --host flag in nuxi dev, as this increases the attack surface to network-based threats.
  • Disable DevTools in nuxt.config if it is not required for active debugging.
  • Deploy the provided Sigma rule to detect suspicious WebSocket connection patterns or atypical child process spawns initiated by the Node.js process running the development server.

Immediate actions

Update @nuxt/devtools to 3.3.1

IT Operations 24h

Threat Hunt

Search for Node.js parent processes spawning shells

T1059.003 medium medium confidence convert to detection

Data: Process creation logs

Mitigations

Disable DevTools in config

immediate IT Operations

CVE-2026-71319

Detection coverage 1

Detect Suspicious Child Process Execution from Node.js

high

Detects potential exploitation of CVE-2026-71319 where a Node.js process spawns unexpected shell-like commands often used in launch-editor exploitation.

sigma tactics: execution techniques: T1059.003 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →