CVE-2025-24361
Last modified
CVE-2025-24361 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-24361?
How severe is CVE-2025-24361?
How do I fix CVE-2025-24361?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-24355Updatecli is a tool used to apply file update strategies. Pr…7.1
- CVE-2025-24356fastd is a VPN daemon which tunnels IP packets and Ethernet …7.5
- CVE-2025-24357vLLM is a library for LLM inference and serving. vllm/model_…8.8
- CVE-2025-24358gorilla/csrf provides Cross Site Request Forgery (CSRF) prev…5.4
- CVE-2025-24359ASTEVAL is an evaluator of Python expressions and statements…8.4
- CVE-2025-24360Nuxt is an open-source web development framework for Vue.js.…5.3
- CVE-2025-24362In some circumstances, debug artifacts uploaded by the CodeQ…7.1
- CVE-2025-24363The HL7 FHIR IG publisher is a tool to take a set of inputs …4.2
- CVE-2025-24364vaultwarden is an unofficial Bitwarden compatible server wri…7.2
- CVE-2025-24365vaultwarden is an unofficial Bitwarden compatible server wri…7.5
- CVE-2025-24366SFTPGo is an open source, event-driven file transfer solutio…7.5
- CVE-2025-24367Cacti is an open source performance and fault management fra…8.8
Are you affected by CVE-2025-24361?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST