# GHSA-rq7w-g337-39qq: When running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that ret

> Nuxt dev server exposes project paths and UUIDs via an unauthenticated endpoint, allowing local or LAN attackers to read sensitive metadata.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Jun 2026

## What is GHSA-rq7w-g337-39qq?

GHSA-rq7w-g337-39qq is a vulnerability in nuxt, published on 15 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

### Summary

When running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that returns the absolute filesystem path of the project root and a per-project UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`. The route is enabled by default via `experimental.chromeDevtoolsProjectSettings: true`.

The endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on `nitro.options.devHandlers` and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has no host / origin / `Sec-Fetch-Site` check of its own.

### Impact

Dev-server only. Production builds do not register the route.

Two values are disclosed:

- `workspace.root`: the absolute filesystem path of the project (commonly reveals the OS username and the on-disk project name).
- `workspace.uuid`: a v4 UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`, stable across dev-server restarts and re-clones.

### Threat model

The response carries no `Access-Control-Allow-Origin` header. A cross-origin `fetch()` from an arbitrary malicious page is therefore blocked by the browser's same-origin policy and cannot read the body. The two realistic recovery paths are:

1. **LAN-adjacent attacker** when the developer runs `nuxt dev --host` (or otherwise binds to a non-loopback interface). A plain `curl http://<dev-lan-ip>:3000/.well-known/appspecific/com.chrome.devtools.json` returns the JSON; no browser, no CORS.
2. **DNS rebinding** against the default loopback dev server. A page the developer visits resolves to the attacker, then re-resolves to `127.0.0.1` after the TTL; the browser believes the request is same-origin and reads the response.

### Affected versions

`nuxt@4.0.0-alpha.1` (PR #32084) through `nuxt@4.4.6`. `3.x` is not affected.

### Reproduction

```bash
npx nuxt dev
curl -s http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json
# {"workspace":{"uuid":"...","root":"/Users/<name>/..."}}
```

### Workaround

Set `experimental: { chromeDevtoolsProjectSettings: false }` in `nuxt.config.ts`. Chrome DevTools' Workspace auto-integration will stop working; the dev server is otherwise unaffected.

### Patches

Fixed in `nuxt@4.4.7` by [#35201](https://github.com/nuxt/nuxt/pull/35201) (commit [`55c75b78`](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)). The handler is now routed through the same host / origin gate the rest of the dev server uses, so the endpoint only responds to requests that look local.

## Which versions are affected by GHSA-rq7w-g337-39qq?

2 open source packages ship an affected version, including nuxt.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `nuxt` | npm | From 4.0.0-alpha.1 | 4.4.7 |
| `nuxt` | npm | From 4.0.0-alpha.1 | 4.4.7 |

## How do I fix GHSA-rq7w-g337-39qq?

Upgrade nuxt to 4.4.7 or later.

## Is GHSA-rq7w-g337-39qq being exploited?

There is no known exploitation of GHSA-rq7w-g337-39qq in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-rq7w-g337-39qq and fix it if it is affected.

What it is: GHSA-rq7w-g337-39qq is a vulnerability in nuxt, published on 15 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-rq7w-g337-39qq in the wild and no public exploit code.

Affected packages and fixed versions:
- nuxt (npm): affected from 4.0.0-alpha.1; fixed in 4.4.7
- nuxt (npm): affected from 4.0.0-alpha.1; fixed in 4.4.7

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-rq7w-g337-39qq/ (Markdown: https://insights.sbomify.com/GHSA-rq7w-g337-39qq/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-rq7w-g337-39qq

---
From sbomify Insights: https://insights.sbomify.com/GHSA-rq7w-g337-39qq/
Summaries are generated and may contain mistakes; the official description above is the record.