Threats tagged 'ghsa-mjrq-cffv-q4qc'

Nuxt development server versions from 3.5.0 up to but not including 4.6.4 can serve files from a parent directory if that directory contains a stray lockfile or workspace settings file, even if the project is not inside a git repository. This allows an attacker who can access the dev server over the network to read arbitrary files under that parent directory, such as SSH keys or cloud credentials. The issue affects only the development server and not production builds. A fix is available in @nuxt/schema 4.6.4 and nuxt 4.6.4.