CVE-2025-24360 - CVE House
Back to Database
Status published Medium CVE-2025-24360

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Vulnerability Description

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24360

Credits & Attribution

No credits recorded in the NVD database.

References

More from nuxt

View All →
CVE-2025-59414
Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival
Low 3.1
CVE-2025-27415
Nuxt allows DOS via cache poisoning with payload rendering response
High 7.5
CVE-2025-24361
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Medium 5.3
CVE-2024-42352
Server-Side Request Forgery (SSRF) in nuxt-icon
High 8.6
CVE-2024-34344
Remote code execution via the browser when running the test locally in nuxt
High 8.8

Affected Vendor

Affected Software

nuxt
Vulnerable Versions:
>= 3.8.1, < 3.15.3

Timeline

Official Publish: January 25th, 2025
Last Modified: February 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration