CVE-2025-24360

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 25, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-243615.3Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 o CVE-2025-243627.1In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment v CVE-2025-243634.2The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Pu CVE-2025-243647.2vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker with authenticated access CVE-2025-243657.5vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights o CVE-2025-243667.5SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set CVE-2025-243678.8Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template CVE-2025-243687.5Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly c CVE-2025-243692.3Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challeng CVE-2025-243709.3Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to pytho CVE-2025-243717.1CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send CVE-2025-243727.3CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could po