TI-2025-18104 Aliases CVE-2025-24361 GHSA-4gf7-ff8x-hq99

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

MEDIUM 57CWE-749Published 2025-01-25 · Updated 2025-02-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00342 27th percentileScored 2026-11-07

Fix Fixed nuxt (nuxt): 3.15.3@nuxt/webpack-builder (npm): 3.15.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nuxt	nuxt	3.0.0 to before 3.15.3; 3.12.2 to before 3.15.3	3.15.3	Patch available	CNA
—	@nuxt/webpack-builder (npm)	3.0.0 to before 3.15.3	3.15.3	Patch available	GHSA-4gf7-ff8x-hq99
—	@nuxt/rspack-builder (npm)	3.12.2 to before 3.15.3	3.15.3	Patch available	GHSA-4gf7-ff8x-hq99

nuxt Vendornuxt Affected 3.0.0 to before 3.15.3; 3.12.2 to before 3.15.3 Fixed in 3.15.3 Patch available CNA
@nuxt/webpack-builder (npm) Vendor— Affected 3.0.0 to before 3.15.3 Fixed in 3.15.3 Patch available GHSA-4gf7-ff8x-hq99
@nuxt/rspack-builder (npm) Vendor— Affected 3.12.2 to before 3.15.3 Fixed in 3.15.3 Patch available GHSA-4gf7-ff8x-hq99

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:nuxt:nuxt::::::::	—	—	nuxt

cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* Versions — — ·nuxt

Remediation

Fix · CNA nuxt (nuxt) Fixed in 3.15.3
Fix · GHSA-4gf7-ff8x-hq99 @nuxt/webpack-builder (npm) Fixed in 3.15.3 Advisory →
Fix · GHSA-4gf7-ff8x-hq99 @nuxt/rspack-builder (npm) Fixed in 3.15.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-24361
2026-10-03 Alias added: GHSA-4gf7-ff8x-hq99

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-24361

Other 3

TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
TI-2026-26689 Nuxt OG Image vulnerable to DoS via image generation CVSS 4.0MEDIUM 6.9
TI-2022-04037 Cross-site Scripting (XSS) - DOM in nuxt/framework CVSS 3.1MEDIUM 6.1
TI-2022-04036 Cross-site Scripting (XSS) - Reflected in nuxt/framework CVSS 3.1MEDIUM 6.1

See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences