Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://<host>:<port>/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use. openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '<command>' }) then openInEditor('<any-existing-file>') to execute an arbitrary program on the developer's machine. This issue is fixed in 3.3.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-06 | 2 | Disclosure2 |
| 2026-08-12 | 1 | Patch1 |
CVE-2026-71319 lets attackers run arbitrary commands via unauthenticated Nuxt DevTools RPC. CVSS 9.6, 7.3M monthly downloads. Patch now. #Nuxt #VueJS #CVE #RCE #CyberSecurity http://securityonline.info/nuxt-devtools-vulnerability/
Post summary
The post announces CVE-2026-71319, highlights its high severity and the ability to run arbitrary commands, and states that a patch is now available.
CVE-2026-71319 Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite H… https://www.cve.org/CVERecord?id=CVE-2026-71319
Post summary
A new CVE (CVE-2026-71319) affecting Nuxt’s DevTools before v3.3.1 has been disclosed, detailing an unintended bidirectional RPC channel in development mode, with no PoC, exploit, patch, or active exploitation reports.
🚨*CVE* CVE-2026-71319 Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite H… https://www.cve.org/CVERecord?id=CVE-2026-71319 ----- Traducción: CVE-2026-71319 Nux… http://infoflow.cloud`
Post summary
A brief tweet discloses CVE-2026-71319, noting that Nuxt DevTools in development mode exposes a bidirectional RPC channel, but it provides no PoC, exploit, patch, or evidence of active use.