Local File Read Vulnerability in Nuxt Development Server
CVE-2026-56301

6.8MEDIUM

Key Information:

Vendor

Nuxt

Status
Nuxt
Vendor
CVE Published:
23 June 2026

What is CVE-2026-56301?

In specific versions of Nuxt, running the development server on Linux allows unprivileged local users to connect to the unprotected vite-node IPC server. This can lead to an arbitrary file read vulnerability, permitting unauthorized access to sensitive files such as environment variables and SSH keys. This issue is limited to development mode, as the IPC server is not exposed in production builds.

Affected Version(s)

Nuxt 4.0.0 < 4.4.7

Nuxt 3.18.0 < 3.21.7

Nuxt 4.4.7

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-534...
vendor-advisory
https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9be...
patch
https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559b...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

alcls01111
.