Unauthenticated RPC in Nuxt DevTools Enables Command Execution on Developer Machines (CVE-2026-71319)

GitHub Security Advisory GHSA-279x-mwfv-vcqv, published August 5, 2026, discloses a critical flaw (CVSS 9.6, tracked as CVE-2026-71319) in @nuxt/devtools that allows arbitrary command execution against a developer's machine — with a public proof-of-concept already available.

What Happened

According to the advisory, Nuxt DevTools exposes a bidirectional RPC channel over the Vite HMR WebSocket (ws://<host>:<port>/, subprotocol vite-hmr) via the nuxt:devtools:rpc plugin. On affected versions, three RPC methods — updateOptions(), clearOptions(), and openInEditor() — fail to enforce the ensureDevAuthToken check that other mutating methods use. Because openInEditor() passes the persisted behavior.openInEditor value to the launch-editor package, which spawns it as a child process, and that value is itself settable via the unauthenticated updateOptions(), an attacker who can reach the HMR endpoint can chain the two calls to execute an arbitrary program. The advisory notes this is limited to development environments; production builds do not run DevTools.

Why It Matters for Defenders

The HMR port can be reached in several realistic scenarios per the advisory: by another process on the same host, by any peer on the LAN when the dev server is started with nuxi dev --host, or — notably — by a malicious website a developer simply visits while the dev server is running, since a browser can open the HMR WebSocket cross-origin. That last vector turns routine web browsing into a potential compromise path for engineers with a Nuxt dev server active, making this relevant to any organization using Nuxt/Vite-based local development, not just production deployments.

What Defenders Should Do Now

• Update @nuxt/devtools to 3.3.1 or later; since nuxt depends on it via a ^3.x range, a lockfile refresh/reinstall is sufficient and no core nuxt release is required.
• Avoid binding local dev servers to non-loopback interfaces (i.e., avoid nuxi dev --host) on untrusted or shared networks.
• Disable DevTools outright where not needed via devtools: { enabled: false } in nuxt.config.
• For endpoint/EDR visibility, consider monitoring for unexpected child processes spawned from Node/Vite dev-server processes, and for unusual WebSocket connections to local HMR ports from browser processes.
• Treat this as a developer-workstation risk during vulnerability triage and asset inventory, since it targets engineering environments rather than production infrastructure.

Developing Intel

This is a same-day advisory and detection coverage/telemetry patterns are still forming; treat details as preliminary pending further community analysis. For the full technical writeup, patch details, and references, see the original advisory: GHSA-279x-mwfv-vcqv.