CVEvulnerability

CVE-2026-119198

5.9 MEDIUM EPSS 0.29% Published 2026-10-29 Modified 2026-11-03 Official page ↗

Exploitation and prioritisation

EPSS
0.29% chance of exploitation in the next 30 days · in the top 78.5% of all CVEs (2026-11-03)
CISA SSVC: exploitation
none
CISA SSVC: automatable
no
CISA SSVC: technical impact
partial
EU Vulnerability Database
EUVD-2026-113369

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
npm@nuxt/vite-builder>= 4.6.0, < 4.6.34.6.3GHSA-x287-wcfc-q46c
Status
Awaiting Analysis
Published
2026-10-29
Last modified
2026-11-03
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-73

Description

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3.

Related

Weakness · CWE (1)

  • CWE-73 External Control of File Name or Path weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-x287-wcfc-q46c Nuxt dev server arbitrary file read through client error reports advisory · npm

References