CVEvulnerability

CVE-2026-119201

4.8 MEDIUM EPSS 0.21% Published 2026-10-29 Modified 2026-10-30 Official page ↗

Exploitation and prioritisation

EPSS
0.21% chance of exploitation in the next 30 days · in the top 89.5% of all CVEs (2026-11-03)
CISA SSVC: exploitation
none
CISA SSVC: automatable
no
CISA SSVC: technical impact
partial
EU Vulnerability Database
EUVD-2026-113372

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
npm@nuxt/vite-builder>= 4.6.0, < 4.6.34.6.3GHSA-3xf4-9g3c-4h4w
Status
Awaiting Analysis
Published
2026-10-29
Last modified
2026-10-30
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-552

Description

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3.

Related

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-3xf4-9g3c-4h4w Nuxt dev server exposes generated appSecret through Vite file serving advisory · npm

References