{"vulnerability": "GHSA-RQ7W-G337-39QQ", "sightings": [{"uuid": "4ff21c4a-7d04-4f39-93dc-a8717dc2472a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RQ7W-G337-39QQ", "type": "seen", "source": "https://gist.github.com/alon710/be69f9c7f59f396504036ec9a026919b", "content": "# GHSA-RQ7W-G337-39QQ: GHSA-RQ7W-G337-39QQ: Project Directory Path and Workspace UUID Disclosure in Nuxt Dev Server\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/GHSA-RQ7W-G337-39QQ\n\n## Summary\nA security vulnerability in the Nuxt development server allows unauthenticated local or cross-origin attackers to retrieve the host machine's absolute project directory path and a persistent Chrome DevTools workspace UUID. The issue stems from an unprotected endpoint registered at `/.well-known/appspecific/com.chrome.devtools.json` which does not validate the HTTP Host, Origin, or Referer headers.\n\n## TL;DR\nThe Nuxt development server exposes a Chrome DevTools workspace endpoint that lacks proper cross-origin or host validation. Remote sites visited by a developer can exfiltrate the local directory path and a workspace UUID via DNS rebinding.\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network / Local\n- **CVSS Score**: 6.5\n- **Impact**: Information Disclosure\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nuxt framework development server\n- **Nuxt**: All versions before patch #35201 (Fixed in: `v3.12.0`)\n\n## Mitigation\n\n- Upgrade Nuxt project dependencies to incorporate PR #35201.\n- Restrict dev server binding to loopback addresses (127.0.0.1 or ::1) instead of 0.0.0.0.\n\n**Remediation Steps:**\n1. Run dependency update command: npm update nuxt (or yarn/pnpm equivalents).\n2. Verify the installation of the fix by sending a request with a non-loopback Host header.\n\n## References\n\n- [GitHub Pull Request #35201](https://github.com/nuxt/nuxt/pull/35201)\n- [Official Fix Commit](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)\n- [GitHub Advisory Database Record](https://github.com/advisories/GHSA-RQ7W-G337-39QQ)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-RQ7W-G337-39QQ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T21:11:17.000000Z"}, {"uuid": "9bf0cba2-01bb-48db-8e93-d6125ea67b6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RQ7W-G337-39QQ", "type": "seen", "source": "https://gist.github.com/alon710/3a26ff1fbe9d67163f9157e06a925a54", "content": "# GHSA-RQ7W-G337-39QQ: GHSA-RQ7W-G337-39QQ: Project Directory Path and Workspace UUID Disclosure in Nuxt Dev Server\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/GHSA-RQ7W-G337-39QQ\n\n## Summary\nA security vulnerability in the Nuxt development server allows unauthenticated local or cross-origin attackers to retrieve the host machine's absolute project directory path and a persistent Chrome DevTools workspace UUID. The issue stems from an unprotected endpoint registered at `/.well-known/appspecific/com.chrome.devtools.json` which does not validate the HTTP Host, Origin, or Referer headers.\n\n## TL;DR\nThe Nuxt development server exposes a Chrome DevTools workspace endpoint that lacks proper cross-origin or host validation. Remote sites visited by a developer can exfiltrate the local directory path and a workspace UUID via DNS rebinding.\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network / Local\n- **CVSS Score**: 6.5\n- **Impact**: Information Disclosure\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nuxt framework development server\n- **Nuxt**: All versions before patch #35201 (Fixed in: `v3.12.0`)\n\n## Mitigation\n\n- Upgrade Nuxt project dependencies to incorporate PR #35201.\n- Restrict dev server binding to loopback addresses (127.0.0.1 or ::1) instead of 0.0.0.0.\n\n**Remediation Steps:**\n1. Run dependency update command: npm update nuxt (or yarn/pnpm equivalents).\n2. Verify the installation of the fix by sending a request with a non-loopback Host header.\n\n## References\n\n- [GitHub Pull Request #35201](https://github.com/nuxt/nuxt/pull/35201)\n- [Official Fix Commit](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)\n- [GitHub Advisory Database Record](https://github.com/advisories/GHSA-RQ7W-G337-39QQ)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-RQ7W-G337-39QQ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T21:21:08.000000Z"}]}