{"action":"Upgrade @nuxt/vite-builder to 3.15.3 or later.","affected":[{"fixed":"3.15.3","introduced":"3.8.1"}],"component":"@nuxt/vite-builder","cve_ids":["CVE-2025-24360"],"ecosystem":"npm","epss":0.00557,"exploited":false,"fixed_versions":["3.15.3"],"ghsa_id":"GHSA-2452-6xj8-jh47","id":"tcs_01M5KERW5KA0K2NS44PN8Z6XVK","modified_at":"2026-02-04T04:01:19.858247Z","published_at":"2025-01-27T11:31:14Z","references":["https://osv.dev/vulnerability/GHSA-2452-6xj8-jh47","https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47","https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6","https://nvd.nist.gov/vuln/detail/CVE-2025-24360","https://github.com/nuxt/nuxt/pull/23995","https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f","https://github.com/nuxt/nuxt","https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263","https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-2452-6xj8-jh47","url":"https://osv.dev/vulnerability/GHSA-2452-6xj8-jh47"}],"summary":"Opening a malicious website while running a Nuxt dev server could allow read-only access to code"}