Threat database

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.6	EPSS 0.6%	CVE-2026-71319nuxt devtools · Code Injection Critical9.6EPSS 0.6%2026-08-05CVE Database V5CVE-2026-71319 A critical code injection vulnerability (CWE-94) exists in Nuxt DevTools versions prior to 3.3.1. The devtools expose an unauthenticated bidirectional RPC channel over the Vite HMR WebSocket, allowing any client with network access to the HMR endpoint to invoke certain RPC methods without authentication. Specifically, the updateOptions() and openInEditor() methods lack proper authentication checks, enabling an attacker to set arbitrary commands and execute them on the developer's machine. This vulnerability is fixed in version 3.3.1. EPSS 0.6%Vulnerability CWE-94	CVE Database V5	2026-08-05
Medium	6.9	EPSS 0.3%	CVE-2025-52662Vercel Nuxt Devtools · Cross-site Scripting Medium6.9EPSS 0.3%2025-11-07CVE Database V5CVE-2025-52662 A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2025-11-07

Page 1 of 1