Nuxt DevTools npm Package Vulnerability: Arbitrary Command Execution
- Severity
- HIGH
- Affected component
- @nuxt/devtools (npm)
- Affected versions
- < 3.3.1 or < 1.3.9 or < 2.6.4
- Patched version
- 3.3.1
An early warning has been issued regarding a critical vulnerability in the Nuxt DevTools npm package. This vulnerability reportedly allows unauthenticated remote procedure call (RPC) execution on the developer's host in development environments.
What happened
The Nuxt DevTools npm package, specifically versions prior to 3.3.1, 1.3.9, or 2.6.4, is under investigation for exposing an unauthenticated RPC channel. This channel may allow arbitrary command execution on the developer's host. The vulnerability has been tracked under the ID GHSA-279X-MWFV-VCQV and was first flagged on 2026-08-05T21:27:39+00:00. There is no evidence that this vulnerability has been exploited in the wild at this time.
Developers using affected versions of Nuxt DevTools are advised to take immediate action to mitigate potential risks. The vulnerability is present in development environments where the Nuxt DevTools package is utilized.
What to do about it
- Update the @nuxt/devtools package to version 3.3.1 to mitigate the vulnerability.
- Avoid running the development server on untrusted networks to reduce exposure risk.
- Review your development environment configurations to ensure they are secure and up to date.
- Monitor the primary sources for any updates or additional information regarding this vulnerability.
How 0Day would have caught this
@nuxt/devtools is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using @nuxt/devtools npm package versions prior to 3.3.1, 1.3.9, or 2.6.4.
What should I do right now?
Update @nuxt/devtools to version 3.3.1 and avoid running the dev server on untrusted networks.
Is there an official fix available?
Yes, version 3.3.1 of @nuxt/devtools is the patched version.