CVE-2026-71319: Remote Code Execution via Unauthenticated RPC in Nuxt DevTools

Vulnerability ID: CVE-2026-71319
CVSS Score: 9.6
Published: 2026-08-05

An unauthenticated remote code execution (RCE) vulnerability exists in Nuxt DevTools prior to version 3.3.1. The vulnerability arises from an unauthenticated RPC channel exposed over the Vite Hot Module Replacement (HMR) WebSocket server, allowing an attacker to modify file editor configurations and execute arbitrary commands under the server context.

TL;DR

Nuxt DevTools before 3.3.1 allows unauthenticated remote attackers to execute arbitrary shell commands via exposed WebSocket RPC endpoints.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-94 / CWE-306
• Attack Vector: Network
• CVSS Score: 9.6
• Exploit Status: Proof of Concept (PoC)
• CISA KEV Status: Not Listed
• Ransomware Association: No

Affected Systems

• Nuxt DevTools
• Nuxt DevTools (@nuxt/devtools): < 3.3.1 (Fixed in: 3.3.1)

Code Analysis

Commit: a7b2718

Fix token validation checks across critical RPC channels (updateOptions, clearOptions, openInEditor)

Enforces devAuthToken parameter across updateOptions, clearOptions, and openInEditor routes inside both the client and the general and options server-rpc controllers.

Mitigation Strategies

• Upgrade @nuxt/devtools to version 3.3.1 or higher.
• Disable Nuxt DevTools completely if upgrading is not immediately possible.
• Restrict bound network interfaces to localhost/loopback address.

Remediation Steps:

1. Identify vulnerable package configurations in package.json or lock files.
2. Run package manager update command: npm update @nuxt/devtools or pnpm update @nuxt/devtools.
3. Verify the installed version is 3.3.1 or later.
4. If updates are blocked, edit nuxt.config.ts to set devtools: { enabled: false }.

References

• GitHub Security Advisory GHSA-279x-mwfv-vcqv
• Fix Commit in Nuxt DevTools Repository
• Nuxt DevTools v3.3.1 Release Notes
• CVE-2026-71319 on CVE.org

Read the full report for CVE-2026-71319 on our website for more details including interactive diagrams and full exploit analysis.