{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/nuxt-devtools/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-71319"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nuxt DevTools"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eNuxt DevTools version 3.x prior to 3.3.1 contains a critical vulnerability (CVE-2026-71319) in its RPC mechanism. The DevTools plugin exposes a bidirectional RPC channel over the Vite HMR WebSocket. This channel lacks authentication, meaning any client capable of reaching the HMR endpoint can issue RPC calls without a handshake or origin verification.\u003c/p\u003e\n\u003cp\u003eThe vulnerability exists because specific methods - specifically \u003ccode\u003eupdateOptions()\u003c/code\u003e and \u003ccode\u003eopenInEditor()\u003c/code\u003e - fail to enforce authentication tokens. An attacker can use \u003ccode\u003eupdateOptions()\u003c/code\u003e to modify the editor configuration to contain an arbitrary command. Subsequently, calling \u003ccode\u003eopenInEditor()\u003c/code\u003e triggers the \u003ccode\u003elaunch-editor\u003c/code\u003e package, which executes the attacker-supplied command as a child process. While Nuxt production builds are unaffected, developers running \u003ccode\u003enuxi dev\u003c/code\u003e - particularly when bound to non-loopback interfaces or when the developer interacts with a malicious website that initiates a cross-origin WebSocket connection - are at significant risk of local command execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a developer running Nuxt DevTools on a reachable port (e.g., 3000) via local network or browser-based cross-origin request.\u003c/li\u003e\n\u003cli\u003eAttacker establishes a WebSocket connection to the Vite HMR endpoint (\u003ccode\u003ews://\u0026lt;host\u0026gt;:\u0026lt;port\u0026gt;/\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker sends a malformed \u003ccode\u003enuxt:devtools:rpc\u003c/code\u003e payload to the \u003ccode\u003eupdateOptions\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eThe payload injects a malicious command string into the \u003ccode\u003ebehavior.openInEditor\u003c/code\u003e configuration key within the session memory.\u003c/li\u003e\n\u003cli\u003eAttacker sends a follow-up RPC call to \u003ccode\u003eopenInEditor\u003c/code\u003e, specifying a file path to trigger the execution logic.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003elaunch-editor\u003c/code\u003e package receives the modified configuration and spawns the malicious command as a child process on the developer's host machine.\u003c/li\u003e\n\u003cli\u003eFinal objective: Achieve arbitrary code execution on the developer's workstation with their current user privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution on the developer's host. This compromises the development environment, potentially allowing the attacker to steal source code, access environment variables, or establish persistent backdoors into the developer's workstation. The scope is limited to development environments, but impacts anyone using affected versions of \u003ccode\u003e@nuxt/devtools\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@nuxt/devtools\u003c/code\u003e to version 3.3.1 or higher across all development projects to remediate CVE-2026-71319.\u003c/li\u003e\n\u003cli\u003eAudit existing projects for the use of the \u003ccode\u003e--host\u003c/code\u003e flag in \u003ccode\u003enuxi dev\u003c/code\u003e, as this increases the attack surface to network-based threats.\u003c/li\u003e\n\u003cli\u003eDisable DevTools in \u003ccode\u003enuxt.config\u003c/code\u003e if it is not required for active debugging.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect suspicious WebSocket connection patterns or atypical child process spawns initiated by the Node.js process running the development server.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T03:25:48Z","date_published":"2026-08-06T03:25:48Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nuxt-devtools-rce/","summary":"An unauthenticated RPC vulnerability in Nuxt DevTools (CVE-2026-71319) allows local or remote attackers to achieve arbitrary command execution by chaining malicious configuration updates and editor launch commands.","title":"Unauthenticated RCE in Nuxt DevTools via Vite HMR WebSocket","url":"https://feed.craftedsignal.io/briefs/2026-08-nuxt-devtools-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Nuxt DevTools","version":"https://jsonfeed.org/version/1.1"}