CVE-2026-71319: Nuxt DevTools Flaw With 7.3 Million Monthly Downloads Allows Arbitrary Command Execution, CVSS 9.6

TL;DR

A critical Nuxt DevTools vulnerability lets an attacker run arbitrary commands on a developer’s machine. Tracked as CVE-2026-71319, it scores 9.6 on CVSS. The Nuxt package sees more than 7.3 million downloads each month.

Why it matters

Nuxt is a popular framework for building Vue.js applications. This Nuxt DevTools vulnerability affects only development mode, not production builds. Still, developer machines hold source code, tokens, and keys. A single compromise can spread far.

How the attack works

DevTools exposes an RPC channel over the Vite HMR WebSocket. On affected versions, that channel has no authentication. Any client that reaches the HMR port can call RPC methods without a token or origin check.

Three methods skip the auth check that other methods enforce. An attacker sets a command through one method, then triggers it through another. That chain achieves arbitrary command execution on the host.

The HMR port is reachable in several ways. A LAN peer can reach it when the server binds with –host. A malicious website can also open the WebSocket cross-origin. This report withholds working exploit steps.

Exploitation status

No public proof-of-concept or in-the-wild exploitation has been confirmed. The flaw was reported through a GitHub security advisory.

Affected versions

The issue affects Nuxt DevTools versions before 3.3.1. Only development environments are exposed.

Patch and mitigation

Update @nuxt/devtools to 3.3.1 or later. Because Nuxt uses a ^3.x range, a lockfile refresh is enough. Avoid binding the dev server to a non-loopback interface on untrusted networks. You can also disable DevTools entirely in the config.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.