Nuxt CVE-2026-56301

Three concrete conditions must all be true: (1) a developer is actively running nuxt dev - the vulnerable IPC server exists only during development, not in production builds; (2) the host is Linux with Node.js 20+ and the dev process is not running inside Docker or StackBlitz (both environments forced the safe filesystem-socket code path even in vulnerable versions); (3) the attacker holds a local, authenticated (PR:L) shell account on the same host and can read /proc/net/unix to enumerate the abstract socket name. Exploitation is fundamentally limited to shared multi-tenant Linux environments. Single-user developer laptops, macOS, Windows, per-job containerized CI, and all production deployments are immune. Remote unauthenticated exploitation is impossible - the attack surface is entirely local.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately characterizes the threat: local access with low privileges, no special attack conditions, and high confidentiality impact. Real-world risk is context-dependent: on shared multi-tenant Linux hosts such as CI runners, university lab machines, or shared bastions, exploitation is straightforward and the payoff (developer credentials, API keys in .env) is high-value. On single-user developer laptops, in per-job containerized CI, or on macOS and Windows, the vulnerability is entirely unexploitable. The development-only scope means production infrastructure is never affected. No CISA KEV listing and no public exploit code were identified at time of analysis, suggesting exploitation has not been observed at scale. However, the low attack complexity (AC:L, AT:N) and the sensitivity of the data accessible (SSH keys, cloud credentials) make this a genuine priority for any team using shared Linux development environments. The absence of integrity and availability impact (VI:N/VA:N) limits the blast radius beyond credential theft.

An attacker with a low-privileged shell account on a shared CI runner or lab machine reads /proc/net/unix to identify the abstract-namespace socket created by a co-resident developer's active nuxt dev process. Using a simple Node.js or Python script to connect to the socket, the attacker sends a crafted module IPC message with a moduleId targeting /home/victim/project/.env?raw, and the Nuxt SSR pipeline returns the file contents verbatim. No public exploit code has been identified at time of analysis, but the attack requires no special tooling beyond standard Unix socket programming.