CVE-2026-71319: 
JavaScript vulnerability analysis and mitigation

CVE-2026-71319 is a critical unauthenticated RPC vulnerability in Nuxt DevTools that allows arbitrary command execution on a developer's host machine. It affects @nuxt/devtools versions prior to 3.3.1 and was published by GitHub Advisory (GHSA-279x-mwfv-vcqv) on July 27, 2026, with public disclosure on August 5, 2026. The vulnerability carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, Nuxt Security Advisory). It is exclusively a development-environment issue; production builds are not affected.

The root cause is a combination of CWE-306 (Missing Authentication for Critical Function) and CWE-94 (Improper Control of Generation of Code), where the Nuxt DevTools bidirectional RPC channel — exposed over the Vite HMR WebSocket (ws://<host>:<port>/, subprotocol vite-hmr) via the nuxt:devtools:rpc plugin — performs no token validation, handshake, or origin check (GitHub Advisory). Specifically, the updateOptions(), clearOptions(), and openInEditor() RPC methods omit the ensureDevAuthToken guard enforced by other mutating methods. An attacker exploits this by first calling updateOptions('behavior', { openInEditor: '<malicious-command>' }) to overwrite the persisted editor setting, then calling openInEditor('<any-existing-file>'), which passes the attacker-controlled value to the launch-editor npm package, spawning it as a child process (Nuxt Security Advisory, Fix Commit). The HMR port is reachable from the same host, from LAN peers when the dev server is started with nuxi dev --host, or cross-origin from a malicious website visited by the developer while the dev server is running.

Successful exploitation grants an unauthenticated attacker full arbitrary code execution on the developer's machine, running as the user who started the Nuxt dev server. This results in high confidentiality, integrity, and availability impact — an attacker can exfiltrate source code, credentials, and environment variables; modify project files; install persistent malware; or pivot to other systems accessible from the developer's workstation (GitHub Advisory). The scope is marked as Changed because the vulnerable DevTools component can affect resources beyond its own security boundary. Impact is strictly limited to development environments, as production builds do not include or run DevTools.

1. Identify a target: Determine that a developer is running a Nuxt dev server with DevTools enabled (default). The HMR WebSocket port (typically 24678 or the Vite dev server port) must be reachable — via same host, LAN, or by luring the developer to a malicious webpage.
2. Establish WebSocket connection: Connect to the Vite HMR WebSocket endpoint (ws://<host>:<port>/) using the vite-hmr subprotocol. No authentication token, handshake, or origin check is required on vulnerable versions.
3. Call updateOptions() RPC method: Send an unauthenticated RPC call to updateOptions('behavior', { openInEditor: '<malicious-command>' }) to overwrite the persisted behavior.openInEditor configuration value with an arbitrary command (e.g., a reverse shell or malware downloader).
4. Trigger openInEditor() RPC method: Send an unauthenticated RPC call to openInEditor('<any-existing-file-path>'). The server reads the previously poisoned behavior.openInEditor value and passes it to the launch-editor npm package, which spawns it as a child process on the developer's machine.
5. Achieve code execution: The attacker-controlled command executes with the privileges of the developer's user account, enabling data exfiltration, persistence, or lateral movement (Nuxt Security Advisory, Fix Commit).

• Network: Unexpected WebSocket connections to the Vite HMR port (commonly 24678 or the configured dev server port) from external or cross-origin sources; outbound connections from the developer's machine to unknown IPs or C2 infrastructure shortly after dev server activity.
• Logs: Node.js process logs showing launch-editor spawning an unexpected child process; Vite/Nuxt dev server logs recording updateOptions or openInEditor RPC calls with unusual parameter values (e.g., shell commands instead of editor paths).
• Process: Unexpected child processes spawned by the Node.js Nuxt dev server process (e.g., bash, sh, curl, wget, powershell, or unknown executables); new network listeners or scheduled tasks created under the developer's user account.
• File System: New or modified files in the project directory or user home directory not attributable to normal development activity; unexpected scripts or binaries written to temp directories.

The fix is available in @nuxt/devtools@3.3.1, which adds ensureDevAuthToken enforcement to the updateOptions(), clearOptions(), and openInEditor() RPC methods (Fix Commit, Release v3.3.1). Because nuxt depends on @nuxt/devtools via a ^3.x range, updating requires only a lockfile refresh (npm install / pnpm install) — no new nuxt package release is needed. Immediate workarounds include: (1) avoid running the dev server bound to a non-loopback interface (nuxi dev --host) on untrusted networks, and (2) disable DevTools entirely by setting devtools: { enabled: false } in nuxt.config (GitHub Advisory).

The vulnerability was credited to researchers TazmiDev and anzuukino, and the advisory was published by Nuxt maintainer danielroe (Nuxt Security Advisory). Coverage appeared on The Hacker Wire and several vulnerability tracking platforms shortly after disclosure (The Hacker Wire). Community reaction has focused on the browser-based cross-origin attack vector as a particularly notable threat model for developer tooling, since it requires no network access beyond a malicious webpage visit.