DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-7C4V-FWGW-9RF7: GHSA-7c4v-fwgw-9rf7: Nuxt Dev Server Discloses Project Root and Workspace UUID via Chrome DevTools Endpoint

#security #cve #cybersecurity #ghsa

GHSA-7c4v-fwgw-9rf7: Nuxt Dev Server Discloses Project Root and Workspace UUID via Chrome DevTools Endpoint

Vulnerability ID: GHSA-7C4V-FWGW-9RF7
CVSS Score: 5.3
Published: 2026-08-07

An information disclosure vulnerability in the Nuxt development server allows adjacent network attackers to retrieve the absolute project root directory and a persistent workspace UUID by querying the unprotected Chrome DevTools workspace endpoint. This occurs when the development server is bound to a network-reachable interface, allowing requests that bypass the header-based security verification checks.

TL;DR

Nuxt development server prior to versions 4.5.1 and 3.21.10 exposes absolute local paths and a workspace UUID over the local network due to weak header-based origin validation. Attackers on the same LAN can query the endpoint by spoofing the Host header.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-200
  • Attack Vector: Adjacent Network (AV:A)
  • CVSS Score: 5.3 (Medium)
  • EPSS Score: Not Assigned (No CVE ID)
  • Impact: Information Disclosure (Path & Workspace UUID)
  • Exploit Status: Proof of Concept / Known Mechanism
  • KEV Status: Not Listed

Affected Systems

  • Nuxt Development Server
  • nuxt: >= 4.4.7, < 4.5.1 (Fixed in: 4.5.1)
  • nuxt: >= 3.21.7, < 3.21.10 (Fixed in: 3.21.10)

Code Analysis

Commit: 00f71bb

Main Fix Commit: secure com.chrome.devtools.json endpoint

Commit: e30c611

Backport/Cherry-pick Commit

Mitigation Strategies

  • Upgrade Nuxt to a patched version
  • Disable the experimental Chrome DevTools project settings
  • Restrict dev server network binding to loopback addresses only
  • Implement local firewall rules to restrict TCP port 3000

Remediation Steps:

  1. Identify your current Nuxt version in package.json
  2. Run npm install nuxt@latest or the equivalent command for your package manager
  3. If immediate patching is not possible, modify nuxt.config.ts to set experimental.chromeDevtoolsProjectSettings to false
  4. Avoid using the --host command-line flag on untrusted local networks

References

Read the full report for GHSA-7C4V-FWGW-9RF7 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)