CVE-2025-24360 Opening a malicious website while running a Nuxt dev server could allow read-only access to code
A malicious website can steal source code from a running Nuxt development server due to permissive default CORS settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-24360?
CVE-2025-24360 is a medium-severity vulnerability in nuxt, published on 25 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.
Weakness: CWE-200
Which versions are affected by CVE-2025-24360?
2 open source packages ship an affected version, including @nuxt/vite-builder.
| Package | Affected | Fixed in |
|---|---|---|
@nuxt/vite-builder npm | From 3.8.1 | 3.15.3 |
@nuxt/vite-builder npm | From 3.8.1 | 3.15.3 |
How do I fix CVE-2025-24360?
Upgrade @nuxt/vite-builder to 3.15.3 or later.
Is CVE-2025-24360 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24360 exists.
Sources
Also known as CLSA-2026-1776040400, CLSA-2026-1792161444, CLSA-2026-1792161585, CLSA-2026-1792161808, CLSA-2026-1792161921, CLSA-2026-1792232953 and 1 more.