Nuxt up to 3.15.2 on Vue routine

Summaryinfo

A vulnerability classified as problematic has been found in Nuxt up to 3.15.2 on Vue. This affects an unknown function. The manipulation leads to routine. This vulnerability is documented as CVE-2025-24361. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Nuxt up to 3.15.2 on Vue. This issue affects some unknown processing. The manipulation with an unknown input leads to a routine vulnerability. Using CWE to declare the problem leads to CWE-749. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-24361 since 01/20/2025. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.15.3 eliminates this vulnerability. Applying the patch 7eeb910bf4accb1e0193b9178c746f06ad3dd88f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Nuxt

Version

• 3.15.0
• 3.15.1
• 3.15.2

License

• open-source

Website

• Product: https://github.com/nuxt/nuxt/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion