{"id":"CVE-2023-3224","aliases":["EUVD-2023-1799","GHSA-gc34-5v43-h7v8"],"status":"published","title":"Code Injection in nuxt/nuxt","description":"Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.58648,"percentile":0.99109,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2023-06-13T00:00:00Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["3.4.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}]}]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}]}]}],"products":[{"vendor":"nuxt","product":"nuxt"},{"vendor":"nuxt","product":"nuxt/nuxt"}],"references":[{"url":"https://huntr.dev/bounties/1eb74fd8-0258-4c1f-a904-83b52e373a87","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/nuxt/nuxt/commit/65a8f4eb3ef1b249a95fd59e323835a96428baff","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3224","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt/commits/v3.4.3","tags":["web"]},{"url":"https://github.com/nuxt/nuxt/issues/21694","tags":["web"]},{"url":"https://github.com/nuxt/nuxt/commit/72ba53efbc2384f802d654fffd92eaf36a81b507","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gc34-5v43-h7v8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3224.json","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-3224","title":"Code Injection in nuxt/nuxt","description":"Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.","status":"published","published":"2023-06-13T00:00:00Z","modified":"2025-01-03T02:10:07.186Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-1799","description":"Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.","status":"published","published":"2023-06-13T00:00:00Z","modified":"2025-01-03T02:10:07Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:27.013318Z"}],"ghsa":[{"id":"GHSA-gc34-5v43-h7v8","title":"nuxt Code Injection vulnerability","description":"he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly.","status":"published","published":"2023-06-13T18:30:40Z","modified":"2024-11-18T16:26:30Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:19.029049Z"}],"nvd":[{"id":"CVE-2023-3224","description":"Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.","status":"published","published":"2023-06-13T18:15:22.37Z","modified":"2026-06-17T06:13:37.203Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:08:06.335469Z"}],"osv":[{"id":"CVE-2023-3224","title":"Code Injection in nuxt/nuxt","description":"Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.","status":"published","published":"2023-06-13T00:00:00Z","modified":"2026-10-28T02:31:00.856738135Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-gc34-5v43-h7v8","title":"nuxt Code Injection vulnerability","description":"he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly.","status":"published","published":"2023-06-13T18:30:40Z","modified":"2024-11-18T16:26:30Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}