Back to overview

CVE-2026-56301

MEDIUM
5.5
CVSS 3.1
Description
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.

Metadata

CVE ID
CVE-2026-56301
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-06-20 12:49 UTC
Published
2026-06-23 12:13 UTC
Last updated
2026-06-23 14:34 UTC
Primary CWE
CWE-276
Incorrect Default Permissions
Vendor / Product
Nuxt / Nuxt
Sources
cve.org  ·  NVD

Severity & Metrics

5.5 MEDIUM CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (2)
VendorProductPlatformVersions
Nuxt Nuxt — 4.0.0 < 4.4.7, 4.4.7
Nuxt Nuxt — 3.18.0 < 3.21.7, 3.21.7
Weakness (CWE)
CWESourceDescription
CWE-276 cna Incorrect Default Permissions
CVSS scores (2)
ScoreSeverityVersionSourceVector
6.8 MEDIUM 4.0 cna CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
5.5 MEDIUM 3.1 cna CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References (4)
Back to overview