CVE-2025-24360

npm/@nuxt/vite-builder CVE-2025-24360: medium 5.3

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Action: Upgrade @nuxt/vite-builder to 3.15.3 or later.

npm i @nuxt/vite-builder@3.15.3

Affected

Fixed versions

Sources

• osv: GHSA-2452-6xj8-jh47
• https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47
• https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6
• https://nvd.nist.gov/vuln/detail/CVE-2025-24360
• https://github.com/nuxt/nuxt/pull/23995
• https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f
• https://github.com/nuxt/nuxt
• https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263
• https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39

CVE-2025-24360 · published 2025-01-27T11:31:14Z · modified 2026-02-04T04:01:19.858247Z · JSON