CVE-2026-71319: Nuxt DevTools RCE Vulnerability

CVE-2026-71319 Overview

CVE-2026-71319 is a critical vulnerability in Nuxt DevTools affecting versions prior to 3.3.1. Nuxt DevTools exposes a bidirectional Remote Procedure Call (RPC) channel over the Vite Hot Module Replacement (HMR) WebSocket via the nuxt:devtools:rpc plugin. The channel has no authentication in development mode. Any client that can reach the Vite HMR endpoint can invoke RPC methods without a token, handshake, or origin check. The updateOptions(), clearOptions(), and openInEditor() methods skip the ensureDevAuthToken verification used by other mutating methods. This gap allows attackers to achieve arbitrary code execution on developer machines. The vulnerability is classified under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Attackers who can reach the HMR port can chain unauthenticated RPC calls to spawn arbitrary programs on a developer's workstation.

Affected Products

Nuxt DevTools versions prior to 3.3.1
Nuxt.js applications running in development mode with DevTools enabled
Environments exposing the Vite HMR WebSocket endpoint to reachable networks

Discovery Timeline

2026-08-05 - CVE-2026-71319 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71319

Vulnerability Analysis

The vulnerability resides in the RPC channel exposed by Nuxt DevTools during development. The channel is registered on the Vite HMR WebSocket using the vite-hmr subprotocol. The RPC framework enforces ensureDevAuthToken on most mutating methods to prevent unauthorized state changes.

Three methods bypass this check: updateOptions(), clearOptions(), and openInEditor(). The openInEditor() method reads the behavior.openInEditor value from persisted options. It passes that value to the launch-editor package, which spawns the specified binary as a child process.

Because updateOptions() is equally unauthenticated, an attacker can overwrite behavior.openInEditor with any command. A subsequent call to openInEditor() with any existing file path triggers execution of the attacker-controlled binary in the developer's process context.

Root Cause

The root cause is missing authentication enforcement on three RPC methods in packages/devtools-kit/src/_types/rpc.ts. The method signatures did not require the dev auth token parameter that other mutating operations require. Combined with the absence of origin or handshake checks on the WebSocket upgrade, this allowed any reachable client to invoke sensitive functionality.

Attack Vector

An attacker connects to ws://<host>:<port>/ with the vite-hmr subprotocol. They call updateOptions('behavior', { openInEditor: '<command>' }) to poison the persisted editor configuration. They then call openInEditor('<any-existing-file>') to trigger the launch-editor package, which spawns the attacker-supplied command. Attack vectors include malicious websites visited by the developer, other users on shared networks, or containers on the same host bridge.

typescript

// Security patch in packages/devtools-kit/src/_types/rpc.ts
// Source: https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4

   // Options
   getOptions: <T extends keyof NuxtDevToolsOptions>(tab: T) => Promise<NuxtDevToolsOptions[T]>
-  updateOptions: <T extends keyof NuxtDevToolsOptions>(tab: T, settings: Partial<NuxtDevToolsOptions[T]>) => Promise<void>
-  clearOptions: () => Promise<void>
+  updateOptions: <T extends keyof NuxtDevToolsOptions>(token: string, tab: T, settings: Partial<NuxtDevToolsOptions[T]>) => Promise<void>
+  clearOptions: (token: string) => Promise<void>

   // Updates
   checkForUpdateFor: (name: string) => Promise<PackageUpdateInfo | undefined>

The patch adds a required token parameter to updateOptions and clearOptions. A corresponding change in packages/devtools/client/composables/editor.ts imports ensureDevAuthToken and applies it to openInEditor calls.

Detection Methods for CVE-2026-71319

Indicators of Compromise

Unexpected child processes spawned by the Node.js development server or the launch-editor package
WebSocket connections to the Vite HMR port from origins other than the developer's own browser tabs
Modifications to persisted Nuxt DevTools options containing shell commands in the behavior.openInEditor field
Outbound network connections initiated from developer workstations shortly after visiting untrusted websites while a Nuxt dev server is running

Detection Strategies

Monitor process creation events on developer endpoints where node, vite, or nuxt processes spawn unexpected shells or interpreters
Inspect Nuxt DevTools configuration files for suspicious values in the openInEditor setting
Correlate WebSocket connections on Vite HMR ports with the parent browser process to identify cross-origin connections

Monitoring Recommendations

Enable endpoint process telemetry on developer workstations to capture command-line arguments of children spawned by Node.js
Log all inbound connections to development server ports and alert on connections from non-localhost sources
Track installed versions of @nuxt/devtools across engineering environments to identify unpatched hosts

How to Mitigate CVE-2026-71319

Immediate Actions Required

Upgrade Nuxt DevTools to version 3.3.1 or later across all development environments
Bind Vite dev servers to 127.0.0.1 rather than 0.0.0.0 to prevent network-reachable HMR endpoints
Audit developer workstations for anomalous child processes spawned by Node.js since the vulnerable versions were installed
Disable Nuxt DevTools in environments where an immediate upgrade is not possible

Patch Information

The issue is fixed in Nuxt DevTools 3.3.1. The fix adds a required token parameter to updateOptions and clearOptions, and enforces ensureDevAuthToken on openInEditor. See the GitHub Security Advisory GHSA-279x-mwfv-vcqv, the GitHub Release v3.3.1, and the upstream commit a7b2718b for details.

Workarounds

Restrict the Vite dev server bind address to loopback only using the --host 127.0.0.1 flag or server.host configuration
Use host-based firewall rules to block inbound connections to development server ports from external interfaces
Avoid browsing untrusted websites while a vulnerable Nuxt dev server is running on the same host
Run development environments inside isolated virtual machines or containers with restrictive network policies

bash

# Configuration example: bind Vite dev server to loopback and upgrade DevTools
npm install @nuxt/devtools@^3.3.1 --save-dev

# nuxt.config.ts snippet
# export default defineNuxtConfig({
#   devServer: {
#     host: '127.0.0.1'
#   }
# })

# Verify installed version
npm ls @nuxt/devtools