# CVE-2026-71319 — nuxt devtools

> As of 2026-08-06, CVE-2026-71319 is a CRITICAL-severity vulnerability in nuxt devtools, CVSS v3.1 9.6, EPSS 0.3% (24.8th percentile). No Threadlinqs-tracked threat campaign has been attributed to CVE-2026-71319 as of 2026-08-06; the identifier is re-checked against the Threadlinqs threat corpus on every daily ingest.

**Last updated:** 2026-08-06

## What is CVE-2026-71319?

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://:/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use. openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '' }) then openInEditor('') to execute an arbitrary program on the developer's machine. This issue is fixed in 3.3.1.

The record classifies CVE-2026-71319 under weakness classes [CWE-94](https://intel.threadlinqs.com/cwe/CWE-94), [CWE-306](https://intel.threadlinqs.com/cwe/CWE-306). Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs a user to take an action first, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 61 days ago.

## Severity and exploitation probability

- **CVSS v3.1 base score:** 9.6 — CRITICAL (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`)
- **EPSS (FIRST):** 0.3% probability of exploitation in the next 30 days, higher than 24.8% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 5.8/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2026-08-05, last modified 2026-08-06

## Is CVE-2026-71319 being exploited?

It currently carries a trending score of 36 in the Threadlinqs vulnerability feed.

## Affected products and versions

- [nuxt](https://intel.threadlinqs.com/vendors/nuxt): devtools

Affected software packages:

- `npm:@nuxt/devtools` — patched in 3.3.1

## How to fix CVE-2026-71319

Fixed versions are recorded for 1 package: npm:@nuxt/devtools 3.3.1. No vendor patch reference has been recorded for CVE-2026-71319 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2026-71319

No threat campaign in the Threadlinqs corpus currently references CVE-2026-71319, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.

## Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on 2026-08-06.

**Vendor advisory and patch**

- [github.com](https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv)

**Other references**

- [github.com](https://github.com/nuxt/devtools/commit/a7b2718b930766e1ffb0640259d53f5b041a50b4)
- [github.com (v3.3)](https://github.com/nuxt/devtools/releases/tag/v3.3.1)

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-71319
Full detection coverage and IOCs for threats exploiting CVE-2026-71319 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp