Medium severity · published Jun 23, 2026
CVE-2026-56301
Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NU
Nuxt · Nuxt
4.0.0 before 4.4.7; 3.18.0 before 3.21.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56301
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56301
Patch
https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9bee872bb8d35246f25ae5
Patch
https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559bff4a1f592f99063c9ea
Third Party Advisory
https://github.com/nuxt/nuxt/security/advisories/GHSA-534h-c3cw-v3h9
Third Party Advisory
https://www.vulncheck.com/advisories/nuxt-arbitrary-file-read-via-world-connectable-vite-node-ipc-socket-on-linux
More from Nuxt
9.8
CVE-2023-3224
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3
8.8
CVE-2024-34344
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js
8.8
CVE-2024-23657
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js
8.2
CVE-2026-71315
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
8.2
CVE-2026-53721
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher