https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 06 Aug 2026 17:32:01 +0000 https://vulnerability.circl.lu/sighting/1830a86e-099c-40b8-9056-9c6d2fb811cf/export {"uuid": "1830a86e-099c-40b8-9056-9c6d2fb811cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71319", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117046328005501280", "content": "Nuxt DevTools <3.3.1 is affected by CVE-2026-71319 (CRITICAL). Unauthenticated Vite HMR WebSocket RPC lets attackers execute arbitrary code via updateOptions() & openInEditor(). Patch to 3.3.1 ASAP. https://radar.offseq.com/threat/cve-2026-71319-cwe-94-improper-control-of-generation-of-code-code-injection-in-nuxt-devtools-d2e93c140a0d8a9f #OffSeq #NuxtJS #CVE202671319 #infosec", "creation_timestamp": "2026-08-06T03:00:33.500480Z"} {"uuid": "1830a86e-099c-40b8-9056-9c6d2fb811cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71319", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117046328005501280", "content": "Nuxt DevTools <3.3.1 is affected by CVE-2026-71319 (CRITICAL). Unauthenticated Vite HMR WebSocket RPC lets attackers execute arbitrary code via updateOptions() & openInEditor(). Patch to 3.3.1 ASAP. https://radar.offseq.com/threat/cve-2026-71319-cwe-94-improper-control-of-generation-of-code-code-injection-in-nuxt-devtools-d2e93c140a0d8a9f #OffSeq #NuxtJS #CVE202671319 #infosec", "creation_timestamp": "2026-08-06T03:00:33.500480Z"} https://vulnerability.circl.lu/sighting/1830a86e-099c-40b8-9056-9c6d2fb811cf/export Thu, 06 Aug 2026 03:00:33 +0000 https://vulnerability.circl.lu/sighting/1749b655-5f0d-4e56-a8e8-5c693d7a8125/export {"uuid": "1749b655-5f0d-4e56-a8e8-5c693d7a8125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71319", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msf2fodwl427", "content": "Nuxt DevTools before 3.3.1 faces a CRITICAL code injection risk \u2014 unauthenticated RPC over Vite HMR WebSocket enables code execution on dev machines. Upgrade to 3.3.1. Details: https://radar.offseq.com/threat/cve-2026-71319-cwe-94-improper-control-of-generation-of-code-code-injection-in-nuxt-devt...", "creation_timestamp": "2026-08-06T03:00:32.553628Z"} {"uuid": "1749b655-5f0d-4e56-a8e8-5c693d7a8125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71319", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msf2fodwl427", "content": "Nuxt DevTools before 3.3.1 faces a CRITICAL code injection risk \u2014 unauthenticated RPC over Vite HMR WebSocket enables code execution on dev machines. Upgrade to 3.3.1. Details: https://radar.offseq.com/threat/cve-2026-71319-cwe-94-improper-control-of-generation-of-code-code-injection-in-nuxt-devt...", "creation_timestamp": "2026-08-06T03:00:32.553628Z"} https://vulnerability.circl.lu/sighting/1749b655-5f0d-4e56-a8e8-5c693d7a8125/export Thu, 06 Aug 2026 03:00:32 +0000 https://vulnerability.circl.lu/sighting/ec75bd3c-3334-43dc-b567-b41599dd9886/export {"uuid": "ec75bd3c-3334-43dc-b567-b41599dd9886", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71319", "type": "seen", "source": "https://gist.github.com/alon710/a043326ccca63ec501e83cde63d8a11d", "content": "# CVE-2026-71319: CVE-2026-71319: Remote Code Execution via Unauthenticated RPC in Nuxt DevTools\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71319\n\n## Summary\nAn unauthenticated remote code execution (RCE) vulnerability exists in Nuxt DevTools prior to version 3.3.1. The vulnerability arises from an unauthenticated RPC channel exposed over the Vite Hot Module Replacement (HMR) WebSocket server, allowing an attacker to modify file editor configurations and execute arbitrary commands under the server context.\n\n## TL;DR\nNuxt DevTools before 3.3.1 allows unauthenticated remote attackers to execute arbitrary shell commands via exposed WebSocket RPC endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94 / CWE-306\n- **Attack Vector**: Network\n- **CVSS Score**: 9.6\n- **Exploit Status**: Proof of Concept (PoC)\n- **CISA KEV Status**: Not Listed\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Nuxt DevTools\n- **Nuxt DevTools (@nuxt/devtools)**: < 3.3.1 (Fixed in: `3.3.1`)\n\n## Mitigation\n\n- Upgrade @nuxt/devtools to version 3.3.1 or higher.\n- Disable Nuxt DevTools completely if upgrading is not immediately possible.\n- Restrict bound network interfaces to localhost/loopback address.\n\n**Remediation Steps:**\n1. Identify vulnerable package configurations in package.json or lock files.\n2. Run package manager update command: `npm update @nuxt/devtools` or `pnpm update @nuxt/devtools`.\n3. Verify the installed version is 3.3.1 or later.\n4. If updates are blocked, edit `nuxt.config.ts` to set `devtools: { enabled: false }`.\n\n## References\n\n- [GitHub Security Advisory GHSA-279x-mwfv-vcqv](https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv)\n- [Fix Commit in Nuxt DevTools Repository](https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4)\n- [Nuxt DevTools v3.3.1 Release Notes](https://github.com/nuxt/devtools/releases/tag/v3.3.1)\n- [CVE-2026-71319 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71319)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71319) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T02:32:30.654950Z"} {"uuid": "ec75bd3c-3334-43dc-b567-b41599dd9886", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71319", "type": "seen", "source": "https://gist.github.com/alon710/a043326ccca63ec501e83cde63d8a11d", "content": "# CVE-2026-71319: CVE-2026-71319: Remote Code Execution via Unauthenticated RPC in Nuxt DevTools\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71319\n\n## Summary\nAn unauthenticated remote code execution (RCE) vulnerability exists in Nuxt DevTools prior to version 3.3.1. The vulnerability arises from an unauthenticated RPC channel exposed over the Vite Hot Module Replacement (HMR) WebSocket server, allowing an attacker to modify file editor configurations and execute arbitrary commands under the server context.\n\n## TL;DR\nNuxt DevTools before 3.3.1 allows unauthenticated remote attackers to execute arbitrary shell commands via exposed WebSocket RPC endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94 / CWE-306\n- **Attack Vector**: Network\n- **CVSS Score**: 9.6\n- **Exploit Status**: Proof of Concept (PoC)\n- **CISA KEV Status**: Not Listed\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Nuxt DevTools\n- **Nuxt DevTools (@nuxt/devtools)**: < 3.3.1 (Fixed in: `3.3.1`)\n\n## Mitigation\n\n- Upgrade @nuxt/devtools to version 3.3.1 or higher.\n- Disable Nuxt DevTools completely if upgrading is not immediately possible.\n- Restrict bound network interfaces to localhost/loopback address.\n\n**Remediation Steps:**\n1. Identify vulnerable package configurations in package.json or lock files.\n2. Run package manager update command: `npm update @nuxt/devtools` or `pnpm update @nuxt/devtools`.\n3. Verify the installed version is 3.3.1 or later.\n4. If updates are blocked, edit `nuxt.config.ts` to set `devtools: { enabled: false }`.\n\n## References\n\n- [GitHub Security Advisory GHSA-279x-mwfv-vcqv](https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv)\n- [Fix Commit in Nuxt DevTools Repository](https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4)\n- [Nuxt DevTools v3.3.1 Release Notes](https://github.com/nuxt/devtools/releases/tag/v3.3.1)\n- [CVE-2026-71319 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71319)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71319) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T02:32:30.654950Z"} https://vulnerability.circl.lu/sighting/ec75bd3c-3334-43dc-b567-b41599dd9886/export Thu, 06 Aug 2026 02:32:30 +0000 https://vulnerability.circl.lu/sighting/0e24e0ca-d8b8-4fa1-acbc-e28234a1499c/export {"uuid": "0e24e0ca-d8b8-4fa1-acbc-e28234a1499c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71319", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msemzkir372n", "content": "\ud83d\udd34 CVE-2026-71319 - Critical (9.6)\n\nNuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (devel...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71319/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-05T23:01:06.968922Z"} {"uuid": "0e24e0ca-d8b8-4fa1-acbc-e28234a1499c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71319", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msemzkir372n", "content": "\ud83d\udd34 CVE-2026-71319 - Critical (9.6)\n\nNuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (devel...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71319/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-05T23:01:06.968922Z"} https://vulnerability.circl.lu/sighting/0e24e0ca-d8b8-4fa1-acbc-e28234a1499c/export Wed, 05 Aug 2026 23:01:06 +0000 https://vulnerability.circl.lu/sighting/4ce8bac2-17cc-4d1d-8752-65a7f97718f6/export {"uuid": "4ce8bac2-17cc-4d1d-8752-65a7f97718f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71319", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3fsizpdnyrbkp", "content": "CVE-2026-71319 - Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution\nCVE ID : CVE-2026-71319\n \n Published : Aug. 5, 2026, 9:26 p.m. | 39\u00a0minutes ago\n \n Description : Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTo...", "creation_timestamp": "2026-08-05T22:26:22.080356Z"} {"uuid": "4ce8bac2-17cc-4d1d-8752-65a7f97718f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71319", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3fsizpdnyrbkp", "content": "CVE-2026-71319 - Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution\nCVE ID : CVE-2026-71319\n \n Published : Aug. 5, 2026, 9:26 p.m. | 39\u00a0minutes ago\n \n Description : Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTo...", "creation_timestamp": "2026-08-05T22:26:22.080356Z"} https://vulnerability.circl.lu/sighting/4ce8bac2-17cc-4d1d-8752-65a7f97718f6/export Wed, 05 Aug 2026 22:26:22 +0000 https://vulnerability.circl.lu/sighting/01e0e07e-2d95-4fe6-a943-b3de9767684d/export {"uuid": "01e0e07e-2d95-4fe6-a943-b3de9767684d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71319", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msekiznbnx2z", "content": "CVE-2026-71319 - devtools\nNuxt DevTools, used in development mode, exposes a vulnerable channel that allows attackers to execute arbitrary commands on the developer's machine. This can happen if an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#devtools #nuxt #npm #CVE #infosec", "creation_timestamp": "2026-08-05T22:16:04.613962Z"} {"uuid": "01e0e07e-2d95-4fe6-a943-b3de9767684d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71319", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msekiznbnx2z", "content": "CVE-2026-71319 - devtools\nNuxt DevTools, used in development mode, exposes a vulnerable channel that allows attackers to execute arbitrary commands on the developer's machine. This can happen if an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#devtools #nuxt #npm #CVE #infosec", "creation_timestamp": "2026-08-05T22:16:04.613962Z"} https://vulnerability.circl.lu/sighting/01e0e07e-2d95-4fe6-a943-b3de9767684d/export Wed, 05 Aug 2026 22:16:04 +0000