CVE-2026-71319: CVE-2026-71319: Remote Code Execution via Unauthenticated RPC in Nuxt DevTools - CVE Security Report

CVE-2026-71319.md

CVE-2026-71319: CVE-2026-71319: Remote Code Execution via Unauthenticated RPC in Nuxt DevTools

CVSS Score: 9.6 Published: 2026-08-05 Full Report: https://cvereports.com/reports/CVE-2026-71319

Summary

An unauthenticated remote code execution (RCE) vulnerability exists in Nuxt DevTools prior to version 3.3.1. The vulnerability arises from an unauthenticated RPC channel exposed over the Vite Hot Module Replacement (HMR) WebSocket server, allowing an attacker to modify file editor configurations and execute arbitrary commands under the server context.

TL;DR

Nuxt DevTools before 3.3.1 allows unauthenticated remote attackers to execute arbitrary shell commands via exposed WebSocket RPC endpoints.

Exploit Status: POC

Technical Details

• CWE ID: CWE-94 / CWE-306
• Attack Vector: Network
• CVSS Score: 9.6
• Exploit Status: Proof of Concept (PoC)
• CISA KEV Status: Not Listed
• Ransomware Association: No

Affected Systems

• Nuxt DevTools
• Nuxt DevTools (@nuxt/devtools): < 3.3.1 (Fixed in: 3.3.1)

Mitigation

• Upgrade @nuxt/devtools to version 3.3.1 or higher.
• Disable Nuxt DevTools completely if upgrading is not immediately possible.
• Restrict bound network interfaces to localhost/loopback address.

Remediation Steps:

1. Identify vulnerable package configurations in package.json or lock files.
2. Run package manager update command: npm update @nuxt/devtools or pnpm update @nuxt/devtools.
3. Verify the installed version is 3.3.1 or later.
4. If updates are blocked, edit nuxt.config.ts to set devtools: { enabled: false }.

References

• GitHub Security Advisory GHSA-279x-mwfv-vcqv
• Fix Commit in Nuxt DevTools Repository
• Nuxt DevTools v3.3.1 Release Notes
• CVE-2026-71319 on CVE.org

---

Generated by CVEReports - Automated Vulnerability Intelligence