CVE-2025-24360mediumCWE-200

CVE-2025-24360: falha de média gravidade em nuxt

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar nuxt+ Monitorar @nuxt/vite-builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.6%
Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
nuxt · nuxt
CVEs relacionadas — nuxt

No mesmo produto, das mais perigosas para as menos.

CVE-2024-23657HIGHPath Traversal: '../filedir' in Nuxt DevtoolsEPSS 1.2%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.9%CVE-2024-34344HIGHRemote code execution via the browser when running the test locally in nuxtEPSS 0.8%CVE-2026-71321HIGHNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationEPSS 0.7%CVE-2026-71320HIGHNuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island PropsEPSS 0.7%CVE-2026-71316HIGHNuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsEPSS 0.5%