GHSA-279x-mwfv-vcqv Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

• npm @nuxt/devtools: < 3.3.1 → fixed in 3.3.1

Impact Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the `nuxt:devtools:rpc` plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (`ws://:/`, subprotocol `vite-hmr`) can call RPC methods, with no token, handshake, or origin check before the channel is established. The `updateOptions()`, `clearOptions()`, and `openInEditor()` methods do not enforce the `ensureDevAuthToken` check that the other mutating methods use. `openInEditor()` reads the persisted `behavior.openInEditor` value and passes it to the `launch-editor` package, which spawns it as a child process. That value is settable through the equally unauthenticated `updateOptions()`. An attacker who can reach the HMR port can therefore chain `updateOptions('behavior', { openInEditor: '' })` then `openInEditor('')` to execute an arbitrary program on the developer's machine. The HMR port is reachable by a process on the same host, by any peer on the LAN when the dev server is bound with `nuxi dev --host`, or by a malicious website the developer visits while the dev server is running (a browser can open the HMR WebSocket cross-origin). Impact is limited to development environments; production builds do not run DevTools. Patches Fixed in `@nuxt/[email protected]`. Because `nuxt` depends on `@nuxt/devtools` through a `^3.x` range, updating is a lockfile refresh / reinstall; no `nuxt` release is required. Workarounds • Update `@nuxt/devtools` to a patched version. • Do not run the dev server bound to a non-loopback interface (`nuxi dev --host`) on an untrusted network. • Disable DevTools entirely with `devtools: { enabled: false }` in `nuxt.config`. References • GHSA-279x-mwfv-vcqv • `launch-editor`: https://www.npmjs.com/package/launch-editor