Alcls01111

Uncontrolled recursion exists in the `formDataToJSON` function when processing `FormData` field names containing deeply nested bracket segments. An attacker can provide `FormData` with field names containing thousands of nested brackets to exhaust the JavaScript call stack, triggering a `RangeError`. This leads to request failure or process termination in applications that do not handle the exception, resulting in a denial of service. This issue affects the `axios.formToJSON(formData)` API, the `formToJSON` import, the `lib/helpers/formDataToJSON.js` file, and the default `transformRequest` when `FormData` is sent with an `application/json` content type. The vulnerability is triggered via the `buildPath()` function, which recursively processes path segments without enforcing a maximum depth.

When the `fetch()` function is called, the runtime validates the destination hostname against `--deny-net` rules but fails to re-verify the IP addresses that the hostname resolves to. This allows an attacker-controlled script to use a specially crafted domain name that passes the initial hostname check but resolves to a denied IP address, effectively bypassing network isolation rules. This can lead to unauthorized access to blocked hosts, such as `localhost` or internal services, particularly when running untrusted or third-party code.

When opening a WebSocket connection, the runtime validates the destination hostname against `--deny-net` rules but fails to re-verify the IP addresses the hostname resolves to. This allows an attacker-controlled script to use a specially crafted domain name that passes the hostname check but resolves to a denied IP, bypassing network isolation rules. This can lead to unauthorized connections to hosts the user intended to block, such as `localhost` or internal services, potentially via a malicious or compromised dependency.

A cross-site scripting issue exists in the NoScript component, which writes slot content to innerHTML without proper escaping. This allows attackers to inject malicious scripts via untrusted data in NoScript slots, such as `route.query` parameters. These scripts execute in the document context when the noscript tag is implicitly closed by script tags.

The `reloadNuxtApp()` function accepts protocol-relative paths, such as //evil.com. These paths bypass the script-protocol check and resolve to a cross-origin URL based on the current page protocol. This allows attackers to inject paths that redirect users to attacker-controlled hosts, which can be used for phishing and the theft of OAuth authorization codes.

Nuxt fails to validate script-capable URLs in the `navigateTo` open option, which allows for client-side script execution. When user-controlled input is passed to `navigateTo`, attackers can provide `javascript:` URLs through the `open` parameter to execute arbitrary scripts within the application's origin.

When running the development server on Linux, the vite-node IPC (Inter-Process Communication) server binds to an abstract-namespace Unix socket without permission restrictions. This allows local users to enumerate and connect to the socket. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files, such as `.env` and SSH keys, through the SSR (Server-Side Rendering) plugin pipeline. Production builds are not affected because the IPC server only operates during development.

Nuxt contains three security issues related to client-navigation URL handling via the `navigateTo()` and `reloadNuxtApp()` functions. First, a server-side open redirect exists in `navigateTo()` where path-normalization bypasses, such as using `/..//evil.com` or `/.//evil.com`, allow attackers to circumvent external-host checks. This results in the browser resolving the redirect to an attacker-controlled host via the Location header or meta-refresh, potentially enabling phishing and OAuth authorization-code theft. Second, a client-side script execution issue exists in `navigateTo()` when the `open` option is used. The handler fails to apply script-protocol checks, allowing targets like `javascript:...` to execute in the application's origin, leading to reflected Cross-Site Scripting (XSS), which is the execution of malicious scripts in a victim's browser. Third, an open redirect exists in `reloadNuxtApp()` via the `path` variable. Protocol-relative paths like `//evil.com` bypass protocol checks and are assigned to `window.location.href`, causing a cross-origin redirect.

An authenticated user can execute arbitrary OS commands on the host system through the Docker file upload functionality. The issue occurs because the `destinationPath` parameter is not properly sanitized and is directly interpolated into a shell command string. By using shell metacharacters such as ; or ", an attacker can escape the intended `docker cp` command.