CVE-2026-56301
Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
Description
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.
INFO
Published Date :
June 23, 2026, 1:16 p.m.
Last Modified :
June 25, 2026, 6:39 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | MEDIUM | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update Nuxt to version 4.4.7 or later.
- Update Nuxt to version 3.21.7 or later.
- Ensure development server is not exposed publicly.
- Limit access to the development environment.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-56301.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-56301 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-56301
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-56301 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-56301 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jun. 25, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.4.7 *cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* versions from (including) 3.18.0 up to (excluding) 3.21.7 Added Reference Type VulnCheck: https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9bee872bb8d35246f25ae5 Types: Patch Added Reference Type VulnCheck: https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559bff4a1f592f99063c9ea Types: Patch Added Reference Type VulnCheck: https://github.com/nuxt/nuxt/security/advisories/GHSA-534h-c3cw-v3h9 Types: Third Party Advisory Added Reference Type VulnCheck: https://www.vulncheck.com/advisories/nuxt-arbitrary-file-read-via-world-connectable-vite-node-ipc-socket-on-linux Types: Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 23, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-56301', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-23T14:34:12.684151Z'} -
New CVE Received by [email protected]
Jun. 23, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Nuxt', 'product': 'Nuxt', 'versions': [{'status': 'affected', 'version': '4.0.0', 'lessThan': '4.4.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '4.4.7', 'versionType': 'semver'}], 'packageURL': 'pkg:npm/nuxt', 'defaultStatus': 'unaffected'}, {'vendor': 'Nuxt', 'product': 'Nuxt', 'versions': [{'status': 'affected', 'version': '3.18.0', 'lessThan': '3.21.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '3.21.7', 'versionType': 'semver'}], 'packageURL': 'pkg:npm/nuxt', 'defaultStatus': 'unaffected'}] Added Description Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development. Added CVSS V4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-276 Added Reference https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9bee872bb8d35246f25ae5 Added Reference https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559bff4a1f592f99063c9ea Added Reference https://github.com/nuxt/nuxt/security/advisories/GHSA-534h-c3cw-v3h9 Added Reference https://www.vulncheck.com/advisories/nuxt-arbitrary-file-read-via-world-connectable-vite-node-ipc-socket-on-linux