Is there a patch available for CVE-2026-56301?

Yes, a patch is available for CVE-2026-56301. Update the affected software to the latest version immediately.

Nuxt CVE-2026-56301

Q: What is the CVSS score of CVE-2026-56301?

CVE-2026-56301 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38436 MEDIUM

Incorrect Default Permissions (CWE-276)

2026-06-23 VulnCheck

GHSA-2x6f-57hp-86fx

Privilege Escalation Nuxt

6.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local low-privilege access required to reach the dev-only abstract socket; high confidentiality impact from arbitrary file read; no integrity or availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 13:10 vuln.today

Analysis Generated

Jun 23, 2026 - 13:10 vuln.today

CVE Published

Jun 23, 2026 - 12:13 cve.org

MEDIUM 6.8

DescriptionCVE.org

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.

AnalysisAI

Nuxt's development server on Linux exposes an unprotected vite-node IPC server via a Linux abstract-namespace Unix socket, enabling unprivileged co-resident users to read arbitrary files - including .env secrets and SSH private keys - through the SSR module pipeline. Affected are Nuxt 4.0.0 through 4.4.6 and Nuxt 3.18.0 through 3.21.6 when running nuxt dev on Linux with Node.js 20+, outside Docker or StackBlitz. No public exploit has been identified at time of analysis, but exploitation demands only a local shell account and basic Unix socket programming knowledge; production builds are entirely unaffected.

Technical ContextAI

The root cause maps to CWE-276 (Incorrect Default Permissions): on Linux with Node.js 20+, Nuxt's internal vite-node IPC server was bound to a Linux abstract-namespace Unix socket (e.g., \0nuxt-vite-node-<pid>-<ts>.sock). Abstract-namespace sockets have no filesystem inode and therefore carry no permission bits; any local process that can read /proc/net/unix can enumerate and connect to them without restriction. The IPC server performs no peer-credential check and no shared-secret handshake before dispatching requests. The module request type passes a moduleId field directly into Vite's SSR fetchModule(), which bypasses Vite's HTTP-layer server.fs.allow deny-list, enabling traversal to arbitrary paths such as /home/dev/project/.env?raw or /home/dev/.ssh/id_rsa?raw. Affected CPE is cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* for both the 3.x and 4.x branches. The fix (commits 1f9f4767 and c293bf95) eliminates the abstract-namespace branch entirely, replacing it with a filesystem socket under a mkdtemp-created directory chmod 0700, with a subsequent chmod 0600 on the socket file and a tight umask wrap during listen() to close the bind-to-chmod race window.

RemediationAI

The definitive fix is to upgrade to nuxt@4.4.7 (for 4.x users) or nuxt@3.21.7 (for 3.x users) via npm install nuxt@4.4.7 or npm install nuxt@3.21.7. Both patch versions are confirmed by the GitHub Security Advisory GHSA-534h-c3cw-v3h9 and the referenced patch commits (https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9bee872bb8d35246f25ae5 for 4.x, https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559bff4a1f592f99063c9ea for 3.x). If an immediate upgrade is not feasible, run nuxt dev inside a per-job container or Docker environment - Docker already triggered the safe filesystem-socket path in vulnerable versions, so this is an effective workaround with minimal operational overhead. Using unshare -U to bind the dev process to a single-user Linux namespace also prevents other local users from reaching the socket. Applying hidepid=2 to /proc mount options limits enumeration of /proc/net/unix but is only a partial mitigation: it reduces socket discoverability but does not eliminate the underlying access-control absence if the socket is otherwise known. Do not rely on network-layer controls for this vector as it is a local Unix socket issue.