CVE-2025-24360 json
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
published 2025-01-25 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-0115 , GHSA-2452-6xj8-jh47
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.
Patch / fix
- npm @nuxt/vite-builder 3.15.3
- nuxt nuxt 3.15.3
- nuxt vite_builder 3.15.3
- github.com/nuxt/nuxt@7eeb910 commit
- github.com/nuxt/nuxt#23995 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @nuxt/vite-builder | >=3.8.1, <3.15.3 |
3.15.3 |
Affected products
- nuxt nuxt
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/nuxt/nuxt/pull/23995
web
-
github.com
/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f
web
-
github.com
/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47
web
-
github.com
/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6
web
-
github.com
/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263
web
-
github.com
/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-24360
advisory
-
github.com
/nuxt/nuxt
package
Sources
- CVE List CVE-2025-24360
- GitHub Advisory GHSA-2452-6xj8-jh47
- NVD CVE-2025-24360
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.