The vulnerability exists because specific methods - specifically updateOptions() and openInEditor() - fail to enforce authentication tokens. An attacker can use updateOptions() to modify the editor configuration to contain an arbitrary command. Subsequently, calling openInEditor() triggers the launch-editor package, which executes the attacker-supplied command as a child process. While Nuxt production builds are unaffected, developers running nuxi dev - particularly when bound to non-loopback interfaces or when the developer interacts with a malicious website that initiates a cross-origin WebSocket connection - are at significant risk of local command execution.

Attack Chain

1. Attacker identifies a developer running Nuxt DevTools on a reachable port (e.g., 3000) via local network or browser-based cross-origin request.
2. Attacker establishes a WebSocket connection to the Vite HMR endpoint (ws://<host>:<port>/).
3. Attacker sends a malformed nuxt:devtools:rpc payload to the updateOptions method.
4. The payload injects a malicious command string into the behavior.openInEditor configuration key within the session memory.
5. Attacker sends a follow-up RPC call to openInEditor, specifying a file path to trigger the execution logic.
6. The launch-editor package receives the modified configuration and spawns the malicious command as a child process on the developer's host machine.
7. Final objective: Achieve arbitrary code execution on the developer's workstation with their current user privileges.

Impact

Successful exploitation results in full remote code execution on the developer's host. This compromises the development environment, potentially allowing the attacker to steal source code, access environment variables, or establish persistent backdoors into the developer's workstation. The scope is limited to development environments, but impacts anyone using affected versions of @nuxt/devtools.

Recommendation

• Update @nuxt/devtools to version 3.3.1 or higher across all development projects to remediate CVE-2026-71319.
• Audit existing projects for the use of the --host flag in nuxi dev, as this increases the attack surface to network-based threats.
• Disable DevTools in nuxt.config if it is not required for active debugging.
• Deploy the provided Sigma rule to detect suspicious WebSocket connection patterns or atypical child process spawns initiated by the Node.js process running the development server.