Executive brief
Nuxt is a popular Vue.js framework used to build web applications. Developers running Nuxt's local development server may have their application source code exposed to attackers if they visit a malicious website while the dev server is running. The attacker can extract the application's code by requesting bundled JavaScript files from the development server, which lack proper access controls. This risk only affects development environments, not production deployments.
Technical details
The vulnerability exists in @nuxt/webpack-builder (versions 3.0.0 to 3.15.3) and @nuxt/rspack-builder (versions 3.12.2 to 3.15.3) due to insufficient CORS (Cross-Origin Resource Sharing) restrictions on the development server. When a developer runs npm run dev, the server exposes bundled JavaScript at paths like /_nuxt/app.js without enforcing same-origin policy. An attacker can inject a script tag pointing to http://localhost:3000/_nuxt/app.js from a malicious website of different origin; since classic script tags bypass CORS, the bundle loads and is exposed to the attacker's code. By calling Function::toString() on webpack chunk objects (window.webpackChunknuxt_app), attackers can extract the full source code including compiled modules and sourcemaps. The attack requires user interaction (opening a malicious site) but no authentication. The fix restricts CORS access to local origins and allows configuration via devServer.cors option.
Affected products
- Nuxt @nuxt/webpack-builder 3.0.0 to 3.15.3
- Nuxt @nuxt/rspack-builder 3.12.2 to 3.15.3
Timeline
- 2025-01-27: disclosed: Vulnerability publicly disclosed via GitHub Security Advisory GHSA-4gf7-ff8x-hq99
- 2025-01-27: patched: Patch available in @nuxt/webpack-builder 3.15.4+ and @nuxt/rspack-builder 3.15.4+