CVE-2025-24361 Opening a malicious website while running a Nuxt dev server could allow read-only access to code
An attacker can steal source code from a running Nuxt dev server by tricking a developer into visiting a malicious website.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-24361?
CVE-2025-24361 is a medium-severity vulnerability in nuxt, published on 25 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.
Weakness: CWE-749
Which versions are affected by CVE-2025-24361?
4 open source packages ship an affected version, including @nuxt/rspack-builder and @nuxt/webpack-builder.
| Package | Affected | Fixed in |
|---|---|---|
@nuxt/rspack-builder npm | From 3.12.2 | 3.15.3 |
@nuxt/rspack-builder npm | From 3.12.2 | 3.15.3 |
@nuxt/webpack-builder npm | From 3.0.0 | 3.15.3 |
@nuxt/webpack-builder npm | From 3.0.0 | 3.15.3 |
How do I fix CVE-2025-24361?
Upgrade @nuxt/rspack-builder to 3.15.3 or later.
Is CVE-2025-24361 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24361 exists.
Sources
Also known as CLSA-2026-1776040398, CLSA-2026-1792161443, CLSA-2026-1792161449, CLSA-2026-1792161583, CLSA-2026-1792161589, CLSA-2026-1792161807 and 4 more.