Is CVE-2025-52662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-52662 being exploited in the wild.

How severe is CVE-2025-52662?

Medium severity, with a CVSS score of 6.9, published 7 November 2025.

Which products and versions are affected?

@nuxt/devtools (npm) SEMVER:introduced=0,fixed=2.6.4; Nuxt DevTools before 2.6.4.

Is there a fix for CVE-2025-52662?

Yes. @nuxt/devtools (npm): upgrade to 2.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-52662 attacked?

It is attacked over the network.

Am I affected by CVE-2025-52662?

Check whether you run @nuxt/devtools (npm) or Nuxt DevTools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-52662: Nuxt DevTools cross-site scripting in auth component

CVE-2025-52662 · Severity: medium · CVSS 6.9 · Published 2025-11-07

Nuxt DevTools is a browser extension used by developers to debug Nuxt.js applications. A cross-site scripting (XSS) vulnerability in the authentication component could allow an attacker to extract authentication tokens and hijack developer sessions, potentially compromising sensitive project data or credentials.

Technologies: @nuxt/devtools (npm), Nuxt DevTools. Vendors: npm, Nuxt.

Quick answers

Is CVE-2025-52662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-52662 being exploited in the wild.
How severe is CVE-2025-52662?: Medium severity, with a CVSS score of 6.9, published 7 November 2025.
Which products and versions are affected?: @nuxt/devtools (npm) SEMVER:introduced=0,fixed=2.6.4; Nuxt DevTools before 2.6.4.
Is there a fix for CVE-2025-52662?: Yes. @nuxt/devtools (npm): upgrade to 2.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-52662 attacked?: It is attacked over the network.
Am I affected by CVE-2025-52662?: Check whether you run @nuxt/devtools (npm) or Nuxt DevTools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nuxt/devtools (npm): upgrade to 2.6.4 or later
```
npm install @nuxt/devtools@2.6.4
```

Technical details

A reflected XSS vulnerability exists in Nuxt DevTools' authentication page (CWE-79) due to unsafe DOM manipulation using `innerHTML` instead of `textContent`. The vulnerability affects all versions prior to 2.6.4. The attack requires user interaction (clicking a malicious link) and a specific configuration, but is network-accessible. A successful exploit allows extraction of Nuxt auth tokens and potential session hijacking. The fix replaces `innerHTML` with `textContent` in the auth component to prevent script injection.

Affected products

Nuxt DevTools before 2.6.4

Identifiers

CVE-2025-52662
GHSA-xmq3-q5pm-rp26

Timeline

2025-11-07: disclosed
2025-11-07: patched: Fixed in version 2.6.4

References

https://github.com/nuxt/devtools/commit/7cadbbe9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.