Nuxt incorrect default permissions in vite-node IPC socket

Executive brief

A security issue in the Nuxt development server allows other users on the same Linux computer to access sensitive files. This affects developers working on shared systems like lab machines or shared servers. An attacker could steal private information such as environment secrets or SSH keys while the development server is running.

Technical details

The Nuxt development server's vite-node IPC mechanism uses Linux abstract-namespace Unix sockets, which lack filesystem permission bits and are accessible to any local user. The IPC server fails to implement authentication or peer-credential checks. An attacker can send a 'module' request to the socket, which triggers Vite's SSR fetchModule() function. Because this internal call bypasses the standard HTTP-layer filesystem restrictions (server.fs.allow), a local attacker can read arbitrary files from the developer's home directory, including .env files and SSH keys. The vulnerability is fixed by switching to filesystem-based Unix sockets with restricted (0600) permissions.

Affected products

• Nuxt Nuxt >= 4.0.0, < 4.4.7
• Nuxt Nuxt >= 3.18.0, < 3.21.7

Timeline

• 2026-06-02: disclosed: Initial publication by danielroe
• 2026-06-16: advisory: GitHub Advisory published/updated

References

• https://api.github.com/users/alcls01111
• https://github.com/alcls01111
• https://api.github.com/users/alcls01111/gists%7B/gist_id%7D
• https://api.github.com/users/alcls01111/repos
• https://avatars.githubusercontent.com/u/57210489?v=4
• https://api.github.com/users/alcls01111/events%7B/privacy%7D