{"action":"Upgrade @nuxt/devtools to 1.3.9 or later.","affected":[{"fixed":"1.3.9","introduced":"0"}],"component":"@nuxt/devtools","cve_ids":["CVE-2024-23657"],"ecosystem":"npm","epss":0.01212,"exploited":false,"fixed_versions":["1.3.9"],"ghsa_id":"GHSA-rcvg-rgf7-pppv","id":"tcs_01M5KG8V96DWA9GCBKDPQYBFJH","modified_at":"2024-08-06T14:38:36Z","published_at":"2024-08-05T19:48:56Z","references":["https://osv.dev/vulnerability/GHSA-rcvg-rgf7-pppv","https://github.com/nuxt/nuxt/security/advisories/GHSA-rcvg-rgf7-pppv","https://nvd.nist.gov/vuln/detail/CVE-2024-23657","https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/dev-auth.ts#L14","https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/assets.ts#L88C48-L88C48","https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/assets.ts#L96C11-L96C28","https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/index.ts#L109","https://github.com/nuxt/nuxt","https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-rcvg-rgf7-pppv","url":"https://osv.dev/vulnerability/GHSA-rcvg-rgf7-pppv"}],"summary":"Nuxt Devtools has a Path Traversal: '../filedir'"}