Bidirectional RPC Channel Vulnerability in Nuxt DevTools Affects Vue.js Framework
CVE-2026-71319

9.6CRITICAL

Key Information:

Vendor

Nuxt

Status
Devtools
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71319?

Nuxt DevTools, a tool for Vue.js web development, has a security issue that allows unauthorized access to a bidirectional RPC channel in development mode. This lack of authentication means that any client with access to the Vite HMR endpoint can invoke RPC methods without proper checks. Specifically, the updateOptions(), clearOptions(), and openInEditor() methods do not enforce the necessary authentication tokens, permitting an attacker to manipulate settings and execute arbitrary commands on a developer's machine. This vulnerability has been addressed in version 3.3.1.

Affected Version(s)

devtools < 3.3.1

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-279...
x_refsource_CONFIRM
https://github.com/nuxt/devtools/commit/a7b2718b930766e1f...
x_refsource_MISC
https://github.com/nuxt/devtools/releases/tag/v3.3.1
x_refsource_MISC

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.