{"action":"Upgrade @nuxt/webpack-builder to 3.15.3 or later.","affected":[{"fixed":"3.15.3","introduced":"3.0.0"}],"component":"@nuxt/webpack-builder","cve_ids":["CVE-2025-24361"],"ecosystem":"npm","epss":0.00337,"exploited":false,"fixed_versions":["3.15.3"],"ghsa_id":"GHSA-4gf7-ff8x-hq99","id":"tcs_01M5KF0CB5J19QZA1YMASYKY55","modified_at":"2026-07-08T08:14:39.936700372Z","published_at":"2025-01-27T11:31:41Z","references":["https://osv.dev/vulnerability/GHSA-4gf7-ff8x-hq99","https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99","https://nvd.nist.gov/vuln/detail/CVE-2025-24361","https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f","https://github.com/nuxt/nuxt"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-4gf7-ff8x-hq99","url":"https://osv.dev/vulnerability/GHSA-4gf7-ff8x-hq99"}],"summary":"Opening a malicious website while running a Nuxt dev server could allow read-only access to code"}