GHSA-7c4v-fwgw-9rf7: Nuxt Dev Server Discloses Project Root and Workspace UUID via Chrome DevTools Endpoint

Vulnerability ID: GHSA-7C4V-FWGW-9RF7
CVSS Score: 5.3
Published: 2026-08-07

An information disclosure vulnerability in the Nuxt development server allows adjacent network attackers to retrieve the absolute project root directory and a persistent workspace UUID by querying the unprotected Chrome DevTools workspace endpoint. This occurs when the development server is bound to a network-reachable interface, allowing requests that bypass the header-based security verification checks.

TL;DR

Nuxt development server prior to versions 4.5.1 and 3.21.10 exposes absolute local paths and a workspace UUID over the local network due to weak header-based origin validation. Attackers on the same LAN can query the endpoint by spoofing the Host header.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-200
Attack Vector: Adjacent Network (AV:A)
CVSS Score: 5.3 (Medium)
EPSS Score: Not Assigned (No CVE ID)
Impact: Information Disclosure (Path & Workspace UUID)
Exploit Status: Proof of Concept / Known Mechanism
KEV Status: Not Listed

Affected Systems

Nuxt Development Server
nuxt: >= 4.4.7, < 4.5.1 (Fixed in: 4.5.1)
nuxt: >= 3.21.7, < 3.21.10 (Fixed in: 3.21.10)

Code Analysis

Commit: 00f71bb

Main Fix Commit: secure com.chrome.devtools.json endpoint

Commit: e30c611

Backport/Cherry-pick Commit

Mitigation Strategies

Upgrade Nuxt to a patched version
Disable the experimental Chrome DevTools project settings
Restrict dev server network binding to loopback addresses only
Implement local firewall rules to restrict TCP port 3000

Remediation Steps:

Identify your current Nuxt version in package.json
Run npm install nuxt@latest or the equivalent command for your package manager
If immediate patching is not possible, modify nuxt.config.ts to set experimental.chromeDevtoolsProjectSettings to false
Avoid using the --host command-line flag on untrusted local networks