{"uuid": "eb935511-a964-49bc-a5da-b7b2266cb5dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7C4V-FWGW-9RF7", "type": "seen", "source": "https://gist.github.com/alon710/9318966a289b67d09be3b424c52f31ab", "content": "# GHSA-7C4V-FWGW-9RF7: GHSA-7c4v-fwgw-9rf7: Nuxt Dev Server Discloses Project Root and Workspace UUID via Chrome DevTools Endpoint\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/GHSA-7C4V-FWGW-9RF7\n\n## Summary\nAn information disclosure vulnerability in the Nuxt development server allows adjacent network attackers to retrieve the absolute project root directory and a persistent workspace UUID by querying the unprotected Chrome DevTools workspace endpoint. This occurs when the development server is bound to a network-reachable interface, allowing requests that bypass the header-based security verification checks.\n\n## TL;DR\nNuxt development server prior to versions 4.5.1 and 3.21.10 exposes absolute local paths and a workspace UUID over the local network due to weak header-based origin validation. Attackers on the same LAN can query the endpoint by spoofing the Host header.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Adjacent Network (AV:A)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: Not Assigned (No CVE ID)\n- **Impact**: Information Disclosure (Path & Workspace UUID)\n- **Exploit Status**: Proof of Concept / Known Mechanism\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nuxt Development Server\n- **nuxt**: >= 4.4.7, < 4.5.1 (Fixed in: `4.5.1`)\n- **nuxt**: >= 3.21.7, < 3.21.10 (Fixed in: `3.21.10`)\n\n## Mitigation\n\n- Upgrade Nuxt to a patched version\n- Disable the experimental Chrome DevTools project settings\n- Restrict dev server network binding to loopback addresses only\n- Implement local firewall rules to restrict TCP port 3000\n\n**Remediation Steps:**\n1. Identify your current Nuxt version in package.json\n2. Run npm install nuxt@latest or the equivalent command for your package manager\n3. If immediate patching is not possible, modify nuxt.config.ts to set experimental.chromeDevtoolsProjectSettings to false\n4. Avoid using the --host command-line flag on untrusted local networks\n\n## References\n\n- [GitHub Advisory Page](https://github.com/advisories/GHSA-7c4v-fwgw-9rf7)\n- [Nuxt Security Advisory Repository](https://github.com/nuxt/nuxt/security/advisories/GHSA-7c4v-fwgw-9rf7)\n- [Nuxt Release v3.21.10](https://github.com/nuxt/nuxt/releases/tag/v3.21.10)\n- [Nuxt Release v4.5.1](https://github.com/nuxt/nuxt/releases/tag/v4.5.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7C4V-FWGW-9RF7) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T09:31:21.430122Z"}