CVE-2025-24361 Information

Description

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy an attacker can inject a malicious script in their site and run the script. By using Function::toString against the values in window.webpackChunknuxt_app the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.

Reference

https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99