CVE-2026-71319

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 3.3.1

Description Nuxt DevTools, when used in development mode, exposes a bidirectional RPC (Remote Procedure Call) channel over the Vite HMR (Hot Module Replacement) WebSocket via the nuxt:devtools:rpc plugin. This channel lacks authentication, allowing any client that can reach the Vite HMR endpoint ws://<host>:<port>/ (subprotocol vite-hmr) to call RPC methods without a token, handshake, or origin check. Specifically, the updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check. An attacker can use updateOptions() to set a malicious command in the behavior.openInEditor value and then call openInEditor() to execute that arbitrary program as a child process on the developer's machine.

Recommendations Update to version 3.3.1.