5.9
MediumCVSS 3.1 · from GitHub_M
CVE-2026-119198
Nuxt dev server arbitrary file read through client error reports
nuxt · CWE-73 · CWE-73Affectednuxt
FixNo fix listed yet.
PublishedOct 29, 20:11 · GitHub_M
ScoredOct 29 · 5.9 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read data. CVSS impact.
Description
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed innuxt>= 4.6.0, < 4.6.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known