Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-24360
CVE-2025-24360:
JavaScript vulnerability analysis and mitigation
Overview
CVE-2025-24360 affects Nuxt, an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send requests to the development server and read the response due to default CORS settings. The vulnerability was discovered and disclosed on January 24, 2025 (NVD, GitHub Advisory).
Technical details
The vulnerability exists because Nuxt uses its own CORS handler by default that sets Access-Control-Allow-Origin: * for development server requests. This implementation was introduced in response to a similar vulnerability in Vite (GHSA-vg6x-rcgg-rjx6). The issue affects the /nuxtvitenode/manifest and /nuxtvitenode/module endpoints. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (GitHub Advisory).
Impact
Users with the default server.cors option using Vite builder may have their source code exposed to malicious websites. When a user visits a malicious website while running a Nuxt development server, the attacker can potentially read source code and sensitive information through cross-origin requests (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been fixed in version 3.15.3. For users unable to upgrade, it is possible to opt-out of the default Nuxt CORS handler by configuring vite.server.cors to restrict allowed origins (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management