Executive brief
Nuxt is a popular web framework for building JavaScript applications. The Nuxt development server in versions 3.4.0 through 3.4.3 is vulnerable to code injection when exposed publicly, allowing remote attackers to execute arbitrary code on the server without authentication.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the Nuxt dev server affecting versions 3.4.0 to 3.4.3. The vulnerability is exploitable remotely without authentication or user interaction, provided the dev server is publicly accessible. An attacker can inject and execute arbitrary code on the server, achieving full compromise. The vulnerability was patched in version 3.4.3 (prior to the security release date). Note: This affects the development server only; production builds are not impacted.
Affected products
- Nuxt Nuxt 3.4.0 to 3.4.3
Timeline
- 2023-06-13: disclosed: Public disclosure via GHSA-gc34-5v43-h7v8
- 2023-06-13: patched: Fixed in Nuxt 3.4.3