CVE-2026-71319

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://<host>:<port>/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use. openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '<command>' }) then openInEditor('<any-existing-file>') to execute an arbitrary program on the developer's machine. This issue is fixed in 3.3.1.

• CWE-94
• CWE-306

• https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4
• https://github.com/nuxt/devtools/releases/tag/v3.3.1
• https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv

Published

Aug 5, 2026

Last Modified

Aug 7, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71312rclone is a command-line program to sync files and directori…8
• CVE-2026-71313rclone is a command-line program to sync files and directori…6.9
• CVE-2026-71314Nuxt is an open-source web development framework for Vue.js.…7.5
• CVE-2026-71315Nuxt is an open-source web development framework for Vue.js.…8.2
• CVE-2026-71316Nuxt is an open-source web development framework for Vue.js.…7.5
• CVE-2026-71318Nuxt is an open-source web development framework for Vue.js.…4.8
• CVE-2026-7132A vulnerability was found in code-projects Online Lot Reserv…5.5
• CVE-2026-71320Nuxt is an open-source web development framework for Vue.js.…8.1
• CVE-2026-71321Nuxt is an open-source web development framework for Vue.js.…7.5
• CVE-2026-71324Traefik is an open source HTTP reverse proxy and load balanc…7
• CVE-2026-71325Traefik is an open-source edge router that makes publishing …4.8
• CVE-2026-71326Traefik is an open source HTTP reverse proxy and load balanc…2.1