CVE-2025-52662: 
JavaScript vulnerability analysis and mitigation

CVE-2025-52662 is a Cross-Site Scripting (XSS) vulnerability in Nuxt DevTools that may allow extraction of Nuxt authentication tokens under certain configurations. It affects all versions of @nuxt/devtools prior to 2.6.4 and was disclosed on November 6–7, 2025, with a patch released in version 2.6.4. The CVSS v3.1 base score is 6.1 (Medium) per NVD, while the CNA (HackerOne) assigned a score of 6.9 (Medium) reflecting higher integrity impact (Github Advisory, Vercel Changelog).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the use of innerHTML instead of textContent in the DevTools authentication page (packages/devtools/src/runtime/auth/index.html). User-controlled input — such as error messages derived from URL parameters or fetch error responses — was rendered via innerHTML, allowing injection of arbitrary HTML/JavaScript (GitHub Commit). The fix replaces all three innerHTML assignments with textContent, preventing script execution. Exploitation requires user interaction (e.g., a victim visiting a crafted URL) and specific DevTools configurations that expose the auth page (Github Advisory).

Successful exploitation could allow an attacker to steal Nuxt authentication tokens from a victim's browser session, potentially leading to unauthorized access to the developer's Nuxt application or DevTools interface. The scope is changed (cross-origin impact), with low confidentiality impact (token exposure) and high integrity impact per the CNA assessment. Since Nuxt DevTools is primarily a development tool, the attack surface is typically limited to development environments, but misconfigured or publicly exposed DevTools instances could broaden the risk (Vercel Changelog, Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.026% (8th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a target running Nuxt DevTools (versions < 2.6.4) with the DevTools auth page accessible, either locally or via an exposed development server.
2. Craft malicious URL: Construct a URL targeting the DevTools auth endpoint (e.g., /_nuxt-devtools/auth/) with a crafted token parameter or by manipulating the error path so that the err.message value contains a malicious HTML/JavaScript payload.
3. Deliver the payload: Trick the developer/victim into clicking the crafted link (e.g., via phishing, a malicious repository README, or a social engineering message), causing their browser to load the auth page with the injected payload.
4. XSS execution: The auth page renders the attacker-controlled string via innerHTML, executing the injected script in the context of the DevTools origin.
5. Token extraction: The malicious script reads the Nuxt auth token from the page context or local storage and exfiltrates it to an attacker-controlled server, enabling session hijacking or unauthorized DevTools access (GitHub Commit, Vercel Changelog).

• Network: Unexpected outbound HTTP requests from a developer's browser to unknown external domains originating from the Nuxt DevTools origin (e.g., /_nuxt-devtools/); requests containing encoded token values in query parameters or POST bodies to attacker-controlled endpoints.
• Logs: Web server or proxy logs showing requests to the DevTools auth endpoint (/_nuxt-devtools/auth/) with unusual or encoded token parameter values; access from unexpected IP addresses to the DevTools interface.
• Browser: Browser console errors related to script execution on the DevTools auth page; unexpected JavaScript execution or network requests triggered from the /_nuxt-devtools/ origin.

The primary remediation is to upgrade @nuxt/devtools to version 2.6.4 or later, which replaces unsafe innerHTML usage with textContent in the auth page (Github Advisory, GitHub Commit). As a workaround, restrict access to the Nuxt DevTools interface to localhost only and avoid exposing development servers to untrusted networks. Developers should also avoid sharing DevTools URLs with untrusted parties.

Vercel published an official changelog entry detailing the vulnerability and its fix, encouraging all users to upgrade (Vercel Changelog). The advisory was assigned via HackerOne, indicating responsible disclosure. Community coverage has been limited to standard vulnerability aggregators and databases, with no notable researcher commentary or significant social media discussion identified.