https://vulnerability.circl.lu/sightings/feed 2026-08-06T14:37:56.218027+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6f595bab-7a1e-4e34-ace6-a679895227c0/export 2026-08-06T14:37:56.248417+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6f595bab-7a1e-4e34-ace6-a679895227c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-279x-mwfv-vcqv", "type": "seen", "source": "https://gist.github.com/alon710/a043326ccca63ec501e83cde63d8a11d", "content": "# CVE-2026-71319: CVE-2026-71319: Remote Code Execution via Unauthenticated RPC in Nuxt DevTools\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71319\n\n## Summary\nAn unauthenticated remote code execution (RCE) vulnerability exists in Nuxt DevTools prior to version 3.3.1. The vulnerability arises from an unauthenticated RPC channel exposed over the Vite Hot Module Replacement (HMR) WebSocket server, allowing an attacker to modify file editor configurations and execute arbitrary commands under the server context.\n\n## TL;DR\nNuxt DevTools before 3.3.1 allows unauthenticated remote attackers to execute arbitrary shell commands via exposed WebSocket RPC endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94 / CWE-306\n- **Attack Vector**: Network\n- **CVSS Score**: 9.6\n- **Exploit Status**: Proof of Concept (PoC)\n- **CISA KEV Status**: Not Listed\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Nuxt DevTools\n- **Nuxt DevTools (@nuxt/devtools)**: < 3.3.1 (Fixed in: `3.3.1`)\n\n## Mitigation\n\n- Upgrade @nuxt/devtools to version 3.3.1 or higher.\n- Disable Nuxt DevTools completely if upgrading is not immediately possible.\n- Restrict bound network interfaces to localhost/loopback address.\n\n**Remediation Steps:**\n1. Identify vulnerable package configurations in package.json or lock files.\n2. Run package manager update command: `npm update @nuxt/devtools` or `pnpm update @nuxt/devtools`.\n3. Verify the installed version is 3.3.1 or later.\n4. If updates are blocked, edit `nuxt.config.ts` to set `devtools: { enabled: false }`.\n\n## References\n\n- [GitHub Security Advisory GHSA-279x-mwfv-vcqv](https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv)\n- [Fix Commit in Nuxt DevTools Repository](https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4)\n- [Nuxt DevTools v3.3.1 Release Notes](https://github.com/nuxt/devtools/releases/tag/v3.3.1)\n- [CVE-2026-71319 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71319)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71319) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T02:32:30.617580Z"} 2026-08-06T02:32:30.617580+00:00