Nuxt
CVE-2025-52662
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 6.9 (MEDIUM). Attack characteristics: network attack vector, high complexity, no privileges required, user interaction required. Public proof-of-concept exploit code is available. EPSS exploitation probability: 0.04%. |
| Exploit ScenarioDerived | A remote attacker could inject malicious scripts into web pages viewed by other users by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools Affected products include: Nuxt Devtools.
Know when Nuxt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.
More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools
Executive ViewAI
Organizations using Nuxt DevTools has been fixed in should be aware of notable risk from CVE-2025-52662, a cross-site scripting vulnerability rated CVSS 6.9. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Proof-of-concept code is publicly available. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)NVD
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3. Rated critical severity (CVSS 9.8), this vulnerability is
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high seve
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high seve
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated high seve
Unauthenticated server-side request forgery in Nuxt OG Image (the npm package nuxt-og-image) 6.0.2 through 6.6.x allows
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Rated medium se
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1. Rated medium severity (CVSS 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13. Rated medium severity
Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2. Rated critical severity (CVSS
Authentication/authorization bypass in Clerk's official JavaScript SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and t
Route-rule middleware bypass in Nuxt 3.11.0-3.21.6 and 4.0.0-4.4.6 allows remote attackers to evade routeRules-defined p
Nuxt is an open-source web development framework for Vue.js. Rated high severity (CVSS 7.5), this vulnerability is remot
Exploit-DB