CVE-2025-52662: Nuxt DevTools XSS Vulnerability

CVE-2025-52662 Overview

CVE-2025-52662 is a Cross-Site Scripting (XSS) vulnerability in Nuxt DevTools, a development-time toolkit for the Nuxt web framework. The flaw resides in the authentication page shipped with the DevTools runtime. Under specific configurations, attackers can inject script content that executes in the developer's browser context. Successful exploitation permits extraction of the Nuxt authentication token used by DevTools. The maintainers addressed the issue in Nuxt DevTools version 2.6.4 by replacing unsafe HTML rendering with text-only rendering in the auth page. All users are encouraged to upgrade to the fixed release.

Critical Impact
Attackers can exfiltrate Nuxt DevTools authentication tokens through reflected XSS in the auth page, granting unauthorized access to development tooling endpoints.

Affected Products

Nuxt DevTools versions prior to 2.6.4
Nuxt applications with DevTools enabled in vulnerable configurations
Development environments exposing the DevTools auth endpoint

Discovery Timeline

2025-11-07 - CVE-2025-52662 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52662

Vulnerability Analysis

The vulnerability is a Cross-Site Scripting flaw classified under [CWE-79]. It exists in the auth handler located at packages/devtools/src/runtime/auth/index.html. When a user opens the auth verification page, the client-side script reads a token value and writes a user-facing message into a DOM element. The pre-patch implementation assigned the message to the element's innerHTML property. Because the surrounding logic branches on the presence of the token parsed from the URL, an attacker who controls the URL can influence page rendering. The result is script execution in the origin of the DevTools auth page, which is the same origin used by Nuxt DevTools to issue authenticated requests.

Root Cause

The root cause is unsafe DOM sink usage. The code assigned strings to innerHTML, which parses and evaluates any embedded HTML and script content. Using innerHTML for message rendering allows tag injection when adjacent logic or crafted URLs reach that code path. The fix replaces innerHTML with textContent, which treats the assigned value as literal text and does not parse markup.

Attack Vector

Exploitation requires user interaction, typically luring a developer to click a crafted DevTools URL. Once the auth page loads, injected script runs in the browser and calls the /auth-verify endpoint or reads token material from the DevTools origin. The attacker then exfiltrates the Nuxt auth token to an external server. The attack executes over the network against local or remote DevTools instances that are reachable to the victim's browser.

text

   const el = document.getElementById('message')
 
   if (!token) {
-    el.innerHTML = '⚠️ No token found, please double check your URL.'
+    el.textContent = '⚠️ No token found, please double check your URL.'
     el.style.color = '#df513f'
   } else {
     fetch(`${location.pathname.split(/\//g).slice(0, -1).join('/')}/auth-verify?token=${token}`)

Source: Nuxt DevTools commit 7cadbbe9. The patch swaps the unsafe innerHTML sink for textContent on the auth page message element.

Detection Methods for CVE-2025-52662

Indicators of Compromise

Outbound HTTP requests from developer workstations to unknown domains immediately after loading a Nuxt DevTools URL.
Unexpected /auth-verify requests originating from browser sessions with anomalous token query parameters.
Presence of Nuxt DevTools versions earlier than 2.6.4 in project package-lock.json or pnpm-lock.yaml files.

Detection Strategies

Perform software composition analysis to identify nuxt/devtools packages below 2.6.4 across repositories and build artifacts.
Inspect browser DevTools network logs for auth page loads containing script fragments in URL parameters.
Review web proxy telemetry for outbound POSTs from developer machines carrying JWT-like or token-shaped strings after Nuxt DevTools activity.

Monitoring Recommendations

Alert on developer endpoints resolving localhost or intranet Nuxt endpoints that subsequently transmit data to external hosts.
Track dependency drift in CI pipelines and fail builds that resolve to vulnerable nuxt/devtools versions.
Monitor referrer and origin headers on /auth-verify requests to detect cross-context invocation.

How to Mitigate CVE-2025-52662

Immediate Actions Required

Upgrade Nuxt DevTools to version 2.6.4 or later in every affected project.
Rotate any Nuxt DevTools authentication tokens that may have been exposed to untrusted URLs.
Disable Nuxt DevTools in production and any shared or internet-reachable environments.

Patch Information

The fix landed in Nuxt DevTools 2.6.4 via commit 7cadbbe9, which replaces innerHTML with textContent in the auth page. Additional context is available in the Vercel Changelog for CVE-2025-52662. Update the dependency and rebuild affected projects to apply the patch.

Workarounds

Restrict Nuxt DevTools to loopback interfaces and block external network access to development ports.
Instruct developers to avoid clicking Nuxt DevTools links received from untrusted sources.
Enforce Content Security Policy (CSP) headers on development origins to limit inline script execution.

bash

# Upgrade Nuxt DevTools to the patched version
npm install -D @nuxt/devtools@^2.6.4

# Verify installed version
npm ls @nuxt/devtools

# Disable DevTools in production configuration (nuxt.config.ts)
# export default defineNuxtConfig({ devtools: { enabled: false } })