CVE-2026-49993

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-749

Affected software

Vendor	Product	Versions
nuxt	nuxt	>= 3.15.4, < 3.21.7; >= 4.0.0, < 4.4.7

References

https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05Patch
https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3Patch
https://github.com/nuxt/nuxt/pull/35200Issue Tracking
https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2gExploit, Mitigation, Patch, Vendor Advisory
https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5Exploit, Mitigation, Patch, Vendor Advisory
https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2gExploit, Mitigation, Patch, Vendor Advisory
https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5Exploit, Mitigation, Patch, Vendor Advisory

Timeline

Published: Jun 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-499949.1Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforc CVE-2026-499954.8Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the news CVE-2026-499963.7SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation CVE-2026-499975.4SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in CVE-2026-499988.2Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse CVE-2026-50007.3A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the function LocalGPTHand CVE-2026-500005.0SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communi CVE-2026-500039.8A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output dire CVE-2026-500057.7Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds.CVE-2026-500069.1Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatib CVE-2026-500077.2Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access CVE-2026-500086.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version