{"answers":{"affected":"2 open source packages ship an affected version, including nuxt.","exploited":"There is no known exploitation of GHSA-rq7w-g337-39qq in the wild and no public exploit code.","fix":"Upgrade nuxt to 4.4.7 or later.","what":"GHSA-rq7w-g337-39qq is a vulnerability in nuxt, published on 15 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-rq7w-g337-39qq and fix it if it is affected.\n\nWhat it is: GHSA-rq7w-g337-39qq is a vulnerability in nuxt, published on 15 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-rq7w-g337-39qq in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- nuxt (npm): affected from 4.0.0-alpha.1; fixed in 4.4.7\n- nuxt (npm): affected from 4.0.0-alpha.1; fixed in 4.4.7\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-rq7w-g337-39qq/ (Markdown: https://insights.sbomify.com/GHSA-rq7w-g337-39qq/index.md)","id":"GHSA-rq7w-g337-39qq","markdown":"https://insights.sbomify.com/GHSA-rq7w-g337-39qq/index.md","name":"GHSA-rq7w-g337-39qq","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Nuxt dev server","requires_auth":"none","summary":"Nuxt dev server exposes project paths and UUIDs via an unauthenticated endpoint, allowing local or LAN attackers to read sensitive metadata.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nWhen running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that returns the absolute filesystem path of the project root and a per-project UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`. The route is enabled by default via `experimental.chromeDevtoolsProjectSettings: true`.\n\nThe endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on `nitro.options.devHandlers` and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has no host / origin / `Sec-Fetch-Site` check of its own.\n\n### Impact\n\nDev-server only. Production builds do not register the route.\n\nTwo values are disclosed:\n\n- `workspace.root`: the absolute filesystem path of the project (commonly reveals the OS username and the on-disk project name).\n- `workspace.uuid`: a v4 UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`, stable across dev-server restarts and re-clones.\n\n### Threat model\n\nThe response carries no `Access-Control-Allow-Origin` header. A cross-origin `fetch()` from an arbitrary malicious page is therefore blocked by the browser's same-origin policy and cannot read the body. The two realistic recovery paths are:\n\n1. **LAN-adjacent attacker** when the developer runs `nuxt dev --host` (or otherwise binds to a non-loopback interface). A plain `curl http://\u003cdev-lan-ip\u003e:3000/.well-known/appspecific/com.chrome.devtools.json` returns the JSON; no browser, no CORS.\n2. **DNS rebinding** against the default loopback dev server. A page the developer visits resolves to the attacker, then re-resolves to `127.0.0.1` after the TTL; the browser believes the request is same-origin and reads the response.\n\n### Affected versions\n\n`nuxt@4.0.0-alpha.1` (PR #32084) through `nuxt@4.4.6`. `3.x` is not affected.\n\n### Reproduction\n\n```bash\nnpx nuxt dev\ncurl -s http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json\n# {\"workspace\":{\"uuid\":\"...\",\"root\":\"/Users/\u003cname\u003e/...\"}}\n```\n\n### Workaround\n\nSet `experimental: { chromeDevtoolsProjectSettings: false }` in `nuxt.config.ts`. Chrome DevTools' Workspace auto-integration will stop working; the dev server is otherwise unaffected.\n\n### Patches\n\nFixed in `nuxt@4.4.7` by [#35201](https://github.com/nuxt/nuxt/pull/35201) (commit [`55c75b78`](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)). The handler is now routed through the same host / origin gate the rest of the dev server uses, so the endpoint only responds to requests that look local.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"When running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that ret","id":"GHSA-rq7w-g337-39qq","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["4.4.7"],"introduced":["4.0.0-alpha.1"],"last_affected":[],"package":"nuxt","purl":null,"source":"GHSA-rq7w-g337-39qq"},{"ecosystem":"npm","fixed":["4.4.7"],"introduced":["4.0.0-alpha.1"],"last_affected":[],"package":"nuxt","purl":"pkg:npm/nuxt","source":"GHSA-rq7w-g337-39qq"}],"products":null,"published":"2026-06-15","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Nuxt dev server exposes project paths and UUIDs via an unauthenticated endpoint, allowing local or LAN attackers to read sensitive metadata.","url":"https://insights.sbomify.com/GHSA-rq7w-g337-39qq/"}