Remote code execution via the browser when running the test locally in nuxt
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands. Users who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page. Since web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nuxt | nuxt | >= 3.4.0 < 3.12.4 | — | No fix listed | CNA |
| — | nuxt (npm) | 3.4.0 to before 3.12.4 | 3.12.4 | Patch available | GHSA-v784-fjjh-f8r4 |
- nuxt Vendornuxt Affected >= 3.4.0 < 3.12.4 Fixed in — No fix listed CNA
- nuxt (npm) Vendor— Affected 3.4.0 to before 3.12.4 Fixed in 3.12.4 Patch available GHSA-v784-fjjh-f8r4
Remediation
- Fix · GHSA-v784-fjjh-f8r4 nuxt (npm) Fixed in 3.12.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34344
- 2026-10-03 Alias added: GHSA-v784-fjjh-f8r4
References
Advisory 2
Other 3
- https://github.com/nuxt/nuxt
- https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L15-L19
- https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L9-L27
More Nuxt vulnerabilities
- TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
- TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
- TI-2026-34788 Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` CVSS 4.0MEDIUM 6.3
- TI-2024-22684 Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt CVSS 3.1MEDIUM 6.3
- TI-2023-00833 Cross-site Scripting (XSS) - Generic in nuxt/framework CVSS 3.1MEDIUM 6.1
- TI-2026-33411 Nuxt: Reflected XSS in `navigateTo()` external redirect CVSS 4.0MEDIUM 5.3
Sources
- CVE-2024-34344 · CVE Program
- CVE-2024-34344 · NVD
- FIRST EPSS
- GHSA-v784-fjjh-f8r4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences