CVE-2024-23657

npm/@nuxt/devtools CVE-2024-23657: high 8.8

Nuxt Devtools has a Path Traversal: '../filedir'

Action: Upgrade @nuxt/devtools to 1.3.9 or later.

npm i @nuxt/devtools@1.3.9

Affected

Fixed versions

Sources

• osv: GHSA-rcvg-rgf7-pppv
• https://github.com/nuxt/nuxt/security/advisories/GHSA-rcvg-rgf7-pppv
• https://nvd.nist.gov/vuln/detail/CVE-2024-23657
• https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/dev-auth.ts#L14
• https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/assets.ts#L88C48-L88C48
• https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/assets.ts#L96C11-L96C28
• https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/index.ts#L109
• https://github.com/nuxt/nuxt
• https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking

CVE-2024-23657 · published 2024-08-05T19:48:56Z · modified 2024-08-06T14:38:36Z · JSON