{"id":"CVE-2025-24360","aliases":["CLSA-2026-1776040400","CLSA-2026-1792161444","CLSA-2026-1792161585","CLSA-2026-1792161808","CLSA-2026-1792161921","CLSA-2026-1792232953","EUVD-2025-0115","GHSA-2452-6xj8-jh47"],"status":"published","title":"Opening a malicious website while running a Nuxt dev server could allow read-only access to code","description":"Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00557,"percentile":0.46708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2025-01-25T00:49:09Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"npm","package":"@nuxt/vite-builder","fixed_in":["3.15.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"nuxt","fixed_in":["3.12.4-tuxcare.3","3.12.3-tuxcare.11"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/kit","fixed_in":["3.12.4-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/schema","fixed_in":["3.12.4-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","fixed_in":["3.12.4-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","fixed_in":["3.12.4-tuxcare.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.1"},{"fixed":"3.15.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.3"}]}],"versions":["3.12.4","3.12.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.3"}]}],"versions":["3.12.4","3.12.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.3"}]}],"versions":["3.12.4","3.12.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.3"}]}],"versions":["3.12.4","3.12.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.3"}]}],"versions":["3.12.4","3.12.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.11"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.10","3.12.3-tuxcare.2","3.12.3-tuxcare.3","3.12.3-tuxcare.4","3.12.3-tuxcare.5","3.12.3-tuxcare.6","3.12.3-tuxcare.7","3.12.3-tuxcare.8","3.12.3-tuxcare.9"]},{"source":"osv","ecosystem":"npm","package":"@nuxt/vite-builder","ranges":[{"type":"SEMVER","events":[{"introduced":"3.8.1"},{"fixed":"3.15.3"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"nuxt","product":"nuxt"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6","tags":["x_refsource_MISC","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/pull/23995","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24360","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2452-6xj8-jh47"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24360.json","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-24360","title":"Opening a malicious website while running a Nuxt dev server could allow read-only access to code","description":"Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.","status":"published","published":"2025-01-25T00:49:09.783Z","modified":"2025-02-12T20:41:32.307Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:44.11109Z"}],"euvd":[{"id":"EUVD-2025-0115","description":"Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.","status":"published","published":"2025-01-25T00:49:09Z","modified":"2025-02-12T20:41:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:56.514594Z"}],"ghsa":[{"id":"GHSA-2452-6xj8-jh47","title":"Opening a malicious website while running a Nuxt dev server could allow read-only access to code","description":"### Summary\nNuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.\n\n### Details\nWhile Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (https://github.com/nuxt/nuxt/pull/23995).\n\nhttps://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263\n\nThat CORS handler sets `Access-Control-Allow-Origin: *`.\n\n\u003e [!IMPORTANT]  \n\u003e If on an affected version, it may be possible to opt-out of the default Nuxt CORS handler by configuring `vite.server.cors`.\n\n### PoC\n1. Start a dev server in any nuxt project using Vite by `nuxt dev`.\n2. Send a fetch request to `http://localhost:3000/_nuxt/app.vue` (`fetch('http://localhost:3000/_nuxt/app.vue')`) from a different origin page.\n\n### Impact\nUsers with the default server.cors option using Vite builder may get the source code stolen by malicious websites\n\n### Additional Information\n`/__nuxt_vite_node__/manifest` / `/__nuxt_vite_node__/module` also seems to have `Access-Control-Allow-Origin: *`, so it maybe also possible to exploit that handler.\nhttps://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39\nAlthough I didn't find a valid module id.\nNote that this handler is probably also vulnerable to DNS rebinding attacks as I didn't find any host header checks.","status":"published","published":"2025-01-27T11:31:14Z","modified":"2025-01-27T11:31:15Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:28.945236Z"}],"nvd":[{"id":"CVE-2025-24360","description":"Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.","status":"published","published":"2025-01-25T01:15:24.047Z","modified":"2026-06-17T08:58:46.437Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:49.483601Z"}],"osv":[{"id":"CVE-2025-24360","title":"Opening a malicious website while running a Nuxt dev server could allow read-only access to code","description":"Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.","status":"published","published":"2025-01-25T00:49:09.783Z","modified":"2026-10-28T02:31:02.162123272Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"GHSA-2452-6xj8-jh47","title":"Opening a malicious website while running a Nuxt dev server could allow read-only access to code","description":"### Summary\nNuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.\n\n### Details\nWhile Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (https://github.com/nuxt/nuxt/pull/23995).\n\nhttps://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263\n\nThat CORS handler sets `Access-Control-Allow-Origin: *`.\n\n\u003e [!IMPORTANT]  \n\u003e If on an affected version, it may be possible to opt-out of the default Nuxt CORS handler by configuring `vite.server.cors`.\n\n### PoC\n1. Start a dev server in any nuxt project using Vite by `nuxt dev`.\n2. Send a fetch request to `http://localhost:3000/_nuxt/app.vue` (`fetch('http://localhost:3000/_nuxt/app.vue')`) from a different origin page.\n\n### Impact\nUsers with the default server.cors option using Vite builder may get the source code stolen by malicious websites\n\n### Additional Information\n`/__nuxt_vite_node__/manifest` / `/__nuxt_vite_node__/module` also seems to have `Access-Control-Allow-Origin: *`, so it maybe also possible to exploit that handler.\nhttps://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39\nAlthough I didn't find a valid module id.\nNote that this handler is probably also vulnerable to DNS rebinding attacks as I didn't find any host header checks.","status":"published","published":"2025-01-27T11:31:14Z","modified":"2026-02-04T04:01:19.858247Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"CLSA-2026-1776040400","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.4-tuxcare.3.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-10-15T09:46:36.959185157Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1792161444","title":"TuxCare security update for @nuxt/kit (1 CVE)","description":"TuxCare rebuilt @nuxt/kit to address 1 CVE. Fixed in 3.12.4-tuxcare.3.","status":"published","published":"2026-10-16T14:37:24Z","modified":"2026-10-16T16:30:31.358844481Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161585","title":"TuxCare security update for @nuxt/schema (1 CVE)","description":"TuxCare rebuilt @nuxt/schema to address 1 CVE. Fixed in 3.12.4-tuxcare.3.","status":"published","published":"2026-10-16T14:39:45Z","modified":"2026-10-16T16:31:27.032253846Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161808","title":"TuxCare security update for @nuxt/vite-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/vite-builder to address 1 CVE. Fixed in 3.12.4-tuxcare.3.","status":"published","published":"2026-10-16T14:43:28Z","modified":"2026-10-16T16:30:34.582819808Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161921","title":"TuxCare security update for @nuxt/webpack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 3.12.4-tuxcare.3.","status":"published","published":"2026-10-16T14:45:21Z","modified":"2026-10-16T16:30:34.729550321Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792232953","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.3-tuxcare.11.","status":"published","published":"2026-10-17T10:29:13Z","modified":"2026-10-17T13:09:28.814399687Z","updated_at":"2026-11-02T15:43:52.011757Z"}]}}