Do Son CVE-2026-71319 lets attackers run arbitrary commands via unauthenticated Nuxt DevTools RPC. CVSS 9.6, 7.3M monthly downloads. Patch now.
Vue.js
Malicious npm packages have been silently destroying files and corrupting data in React, Vue.js, and Vite projects for over two years.