Nuxt Framework Vulnerability Allows Arbitrary Code Execution

CVE-2024-34344

Summary

The Nuxt framework, an open-source tool used for building web applications with Vue.js, has a vulnerability resulting from inadequate validation of the 'path' parameter within the NuxtTestComponentWrapper. This flaw enables attackers to execute arbitrary JavaScript code on the server side. When users run tests locally and access malicious web pages, an attacker can exploit this vulnerability, leading to potential remote code execution. The impact can be particularly severe, as it allows malicious web pages to send requests to arbitrary addresses. Consequently, the vulnerability could be triggered every time the test server runs, making it critical for users to apply necessary security measures.

References