CVE-2026-71319

{
  "id": "CVE-2026-71319",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-05T22:17:08.227",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://<host>:<port>/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use. openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '<command>' }) then openInEditor('<any-existing-file>') to execute an arbitrary program on the developer's machine. This issue is fixed in 3.3.1."
    },
    {
      "lang": "es",
      "value": "Nuxt es un framework de desarrollo web de código abierto para Vue.js. Antes de la versión 3.3.1, Nuxt DevTools (solo en modo de desarrollo) expone un canal RPC bidireccional a través del WebSocket HMR de Vite mediante el plugin nuxt:devtools:rpc. En las versiones afectadas, el canal no tiene autenticación: cualquier cliente que pueda alcanzar el endpoint HMR de Vite (ws://[host]:[port]/, subprotocolo vite-hmr) puede llamar a métodos RPC, sin token, handshake o verificación de origen antes de que se establezca el canal. Los métodos updateOptions(), clearOptions() y openInEditor() no aplican la verificación ensureDevAuthToken que utilizan los otros métodos mutadores. openInEditor() lee el valor persistido behavior.openInEditor y lo pasa al paquete launch-editor, que lo genera como un proceso hijo. Ese valor es configurable a través del igualmente no autenticado updateOptions(). Un atacante que pueda alcanzar el puerto HMR puede, por lo tanto, encadenar updateOptions(’behavior’, { openInEditor: ’[command]’ }) y luego openInEditor(’[any-existing-file]’) para ejecutar un programa arbitrario en la máquina del desarrollador. Este problema está solucionado en la versión 3.3.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nuxt",
          "product": "devtools",
          "versions": [
            {
              "version": "< 3.3.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-06T00:00:00+00:00",
          "id": "CVE-2026-71319",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nuxt/devtools/releases/tag/v3.3.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv",
      "source": "[email protected]"
    }
  ]
}