When running 'nuxt dev' on Linux with Node.js 20+ outside Docker or StackBlitz, Nuxt's vite-node IPC server uses an abstract-namespace Unix socket that lacks filesystem permissions, making it world-connectable to any local user able to read /proc/net/unix. The IPC server does not verify peer credentials or use shared secrets, allowing local attackers to send 'module' requests that fetch arbitrary files via Vite's SSR fetchModule() without filesystem access restrictions. This can expose sensitive developer files such as .env or SSH keys. The vulnerability affects only development mode on shared multi-tenant Linux hosts. It is fixed in Nuxt 4.4.7 and 3.21.7 by binding to a filesystem socket with chmod 0600 permissions, restricting access to the owning user. Workarounds include running in containers or restricting /proc/net/unix visibility.

Local unprivileged users on a shared multi-tenant Linux host can connect to the Nuxt dev server's IPC socket and request arbitrary files from the developer's filesystem, potentially exposing sensitive information such as environment variables and private keys. This does not affect production builds or containerized environments and requires local access with the ability to enumerate Unix sockets via /proc/net/unix.

A patch is available and should be applied by upgrading to Nuxt 4.4.7 or 3.21.7, which replace the abstract socket with a filesystem socket restricted by chmod 0600 permissions. If immediate upgrade is not possible, run 'nuxt dev' inside a container or VM with no other tenants, bind the process to a single-user namespace, or restrict visibility of /proc/net/unix using hidepid=2 mount options as partial mitigations.