Unauthenticated RPC leading to command execution in Nuxt DevTools (CVE-2026-71319)

Nuxt DevTools exposes a bidirectional RPC channel over the Vite HMR WebSocket with no authentication, token, handshake, or origin check. The `updateOptions()` and `openInEditor()` methods bypass the `ensureDevAuthToken` guard, allowing any client that can reach the HMR port to chain these calls and execute an arbitrary program on the developer's machine. Attack vectors include same-host processes, LAN peers when the server is bound with `--host`, and cross-origin WebSocket connections initiated by a malicious website. Affected versions: - < 3.3.1 We recommend updating to: 3.3.1. CVSS 9.6 · our assessment: act_now Reference: https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv Details: https://vuln.today/cve/CVE-2026-71319