CVE-2026-56301
Last modified
CVE-2026-56301 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. EPSS estimates a 0.10% chance of exploitation in the next 30 days.
Description
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nuxt | Nuxt | >= 3.18.0, < 3.21.7 |
| Nuxt | Nuxt | >= 4.0.0, < 4.4.7 |
References
- https://github.com/nuxt/nuxt/security/advisories/GHSA-534h-c3cw-v3h9Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-56301?
How severe is CVE-2026-56301?
How do I fix CVE-2026-56301?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-56296Cap-go before 12.128.2 contains an information disclosure vu…6.9
- CVE-2026-56297FreeRDP before 3.22.0 contains a use-after-free vulnerabilit…8.1
- CVE-2026-56298Capgo before 12.128.2 fails to strip EXIF metadata from imag…5.3
- CVE-2026-56299Capgo before 12.128.2 contains an authentication bypass vuln…6.9
- CVE-2026-5630A flaw has been found in assafelovic gpt-researcher up to 3.…4.3
- CVE-2026-56300Capgo before 12.128.2 contains unauthenticated security defi…8.7
- CVE-2026-56302Capgo before 12.128.2 contains an unsecured images bucket la…6.9
- CVE-2026-56303Capgo before 12.128.2 contains an information disclosure vul…8.7
- CVE-2026-56304picklescan before 1.0.1 contains an unsafe pickle deserializ…6.9
- CVE-2026-56305Capgo before 12.128.2 contains an authentication bypass vuln…8.7
- CVE-2026-56306Capgo before 12.128.2 contains a weak parsing vulnerability …6.4
- CVE-2026-56307Cap-go before 12.128.12 contains a broken cursor pagination …5.3
Are you affected by CVE-2026-56301?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST