Threats affecting pkg:github/nuxt/devtools

A critical code injection vulnerability (CWE-94) exists in Nuxt DevTools versions prior to 3.3.1. The devtools expose an unauthenticated bidirectional RPC channel over the Vite HMR WebSocket, allowing any client with network access to the HMR endpoint to invoke certain RPC methods without authentication. Specifically, the updateOptions() and openInEditor() methods lack proper authentication checks, enabling an attacker to set arbitrary commands and execute them on the developer's machine. This vulnerability is fixed in version 3.3.1.

A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools