AIKIDO-2026-72858
@nuxt/devtools is vulnerable to Remote Code Execution (RCE)
96
Critical Risk
This Affects:
@nuxt/devtoolsTL;DR
Nuxt DevTools contains an authentication bypass in its development-only RPC interface that can lead to remote code execution. An attacker able to access the Vite HMR WebSocket can invoke unauthenticated RPC methods to modify the openInEditor configuration and trigger execution of an arbitrary command on the developer's machine. The vulnerability affects development environments only and can be exploited by local processes, hosts on the same network when the development server is exposed, or malicious websites via cross-origin WebSocket connections.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and run Nuxt DevTools in a development environment where the Vite HMR WebSocket is reachable (local processes, same-network hosts when the dev server is exposed, or cross-origin WebSocket access from a browser).
Background info
@nuxt/devtools is vulnerable to Remote Code Execution (RCE) in versions 0.0.1 - 3.3.0.
How to fix this
Upgrade the @nuxt/devtools library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant