Executive brief
Nuxt DevTools is a browser extension used by developers to debug Nuxt.js applications. A cross-site scripting (XSS) vulnerability in the authentication component could allow an attacker to extract authentication tokens and hijack developer sessions, potentially compromising sensitive project data or credentials.
Technical details
A reflected XSS vulnerability exists in Nuxt DevTools' authentication page (CWE-79) due to unsafe DOM manipulation using `innerHTML` instead of `textContent`. The vulnerability affects all versions prior to 2.6.4. The attack requires user interaction (clicking a malicious link) and a specific configuration, but is network-accessible. A successful exploit allows extraction of Nuxt auth tokens and potential session hijacking. The fix replaces `innerHTML` with `textContent` in the auth component to prevent script injection.
Affected products
- Nuxt DevTools before 2.6.4
Timeline
- 2025-11-07: disclosed
- 2025-11-07: patched: Fixed in version 2.6.4