Medium severity · published Jan 25, 2025
CVE-2025-24360
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NU
nuxt · nuxt
>= 3.8.1, < 3.15.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24360
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24360
github.com
https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263
github.com
https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39
github.com
https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f
github.com
https://github.com/nuxt/nuxt/pull/23995
github.com
https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47
github.com
https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6
More from nuxt
9.8
CVE-2023-3224
Code Injection in nuxt/nuxt
8.8
CVE-2024-34344
Remote code execution via the browser when running the test locally in nuxt
8.8
CVE-2024-23657
Path Traversal: '../filedir' in Nuxt Devtools
8.2
CVE-2026-71315
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
8.2
CVE-2026-53721
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher