Executive brief
Nuxt is a popular JavaScript framework for building web applications. When running tests locally, a special test component can be exploited to execute arbitrary code on the development server through a malicious web page. An attacker can craft a URL that bypasses path validation and injects malicious JavaScript, allowing remote command execution during local testing sessions.
Technical details
The vulnerability exists in the NuxtTestComponentWrapper component, which dynamically loads and renders components based on a path parameter. The path parameter is validated to prevent directory traversal using resolve(), but the actual dynamic import uses the unvalidated original path string. An attacker can bypass the validation by using data: URIs (e.g., data:text/javascript;base64,...) that resolve() treats as relative paths but import() treats as absolute URIs. The vulnerability requires user interaction—a user must open a malicious URL in their browser while the Nuxt test server is running—but a malicious website can repeatedly attempt exploitation. The vulnerability affects versions 3.4.0 through 3.12.3 and was patched in version 3.12.4.
Affected products
- Nuxt Nuxt 3.4.0 to 3.12.3
Timeline
- 2024-08-05: disclosed
- 2024-08-05: patched: Fixed in version 3.12.4