CVE-2025-24360

Published: Jan 25, 2025Modified: Jun 17, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.6 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/pull/23995

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47

Source: security-advisories@github.com

https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6

Source: security-advisories@github.com

Timeline

No history available yet.