External risk intelligence

Nuxt DevTools Remote Code Execution via Unauthenticated RPC Channel

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-71319

This vulnerability exists only in Nuxt DevTools, which is explicitly limited to development mode. It is designed for use by developers on local machines, not for production or public-facing deployment. Exposure to the internet is inconsistent with the intended use of a local development tool.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Nuxt DevTools, a development tool for Vue.js applications, could allow an unauthenticated attacker to execute arbitrary code on a developer's machine by sending specially crafted requests over a WebSocket connection. This issue is present in development mode only, and exploitation requires the attacker to be able to reach the Vite Hot Module Replacement (HMR) endpoint.

Unauthenticated code execution in developer tools.
Development mode vulnerability, limited exposure.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker who can access the Vite development server's WebSocket connection can exploit this vulnerability. By sending unauthenticated RPC calls, they can manipulate development tool settings to execute arbitrary commands on the developer's machine. This occurs because the tool's RPC channel lacks proper authentication, allowing untrusted clients to trigger sensitive functions.

Requires network access to the development server.
Triggers via unauthenticated RPC calls.
Risks arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

The Nuxt DevTools, when running in development mode, could allow an attacker to execute arbitrary commands on a developer's machine. This is possible because an unauthenticated RPC channel within the DevTools lacks proper security checks, enabling an attacker to manipulate settings and trigger code execution through a specific file editing function. This risk is limited to development environments accessible to an attacker.

Arbitrary code execution on developer machines.
Unauthenticated access to DevTools RPC channel.
Compromised developer machine and code.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Nuxt DevTools, a tool intended for development environments, not production. Application development teams or individuals managing developer environments are likely responsible for addressing this. The first practical step is to confirm if any developer machines are exposing the Vite HMR endpoint to an untrusted network, then identify the accountable owner for those environments.

Identify developer environments using Nuxt DevTools.
Verify exposure of HMR WebSocket endpoint.
Coordinate developer remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Nuxt DevTools and why is it used?

Nuxt DevTools is a suite of debugging and inspection utilities designed for developers building applications with the Nuxt framework for Vue.js. It helps programmers visualize application state, routing, and component structures during the coding process. Because it is intended solely for local development environments, it is typically launched by developers on their personal workstations to accelerate the software creation lifecycle.

How does CVE-2026-71319 lead to unauthorized code execution?

This vulnerability involves Improper Authentication (CWE-306) and Code Injection (CWE-94). The DevTools RPC channel lacks security checks, allowing any caller to invoke sensitive methods. By chaining an update to the editor settings with a file-opening command, an unauthorized user can force the development server to launch arbitrary programs. Essentially, the tool trusts external instructions that it should have verified, granting an attacker control over the host environment.

Do I need an active connection to the developer server to trigger this?

Yes, an attacker must be able to reach the Vite Hot Module Replacement (HMR) WebSocket endpoint. If your development server is bound only to 'localhost' and not accessible over a network, this vulnerability cannot be triggered remotely. Simply browsing a website or interacting with a public application does not trigger this issue, as the bug is specific to the underlying developer-only communication channel.

Is this vulnerability relevant to my production applications?

According to Halo Surface Signal, it is very unlikely. This vulnerability is restricted to the development mode of Nuxt DevTools. Because these tools are designed for private developer environments rather than production or public-facing servers, they should not be exposed to the internet. If you find this endpoint reachable from untrusted networks, it indicates a misconfiguration where a local development service has been inadvertently exposed.

When should I update my Nuxt environment?

You should update to Nuxt DevTools version 3.3.1 immediately if you use this framework. The primary action is to audit your development environments to ensure that Vite HMR ports are not accessible to unauthorized users or exposed across untrusted networks. Once you have identified any machines running affected versions of the toolkit, applying the version update will restore necessary authentication checks to the RPC channel.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.