GHSA-RQ7W-G337-39QQ

When running nuxt dev, Nuxt registers an unauthenticated route at /.well-known/appspecific/com.chrome.devtools.json that returns the absolute filesystem path of the project root and a per-project UUID persisted to node_modules/.cache/nuxt/chrome-workspace.json. The route is enabled by default via experimental.chromeDevtoolsProjectSettings: true.

The endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on nitro.options.devHandlers and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has no host / origin / Sec-Fetch-Site check of its own.

Threat model

The response carries no Access-Control-Allow-Origin header. A cross-origin fetch() from an arbitrary malicious page is therefore blocked by the browser's same-origin policy and cannot read the body. The two realistic recovery paths are:

1. LAN-adjacent attacker when the developer runs nuxt dev --host (or otherwise binds to a non-loopback interface). A plain curl http://<dev-lan-ip>:3000/.well-known/appspecific/com.chrome.devtools.json returns the JSON; no browser, no CORS.
2. DNS rebinding against the default loopback dev server. A page the developer visits resolves to the attacker, then re-resolves to 127.0.0.1 after the TTL; the browser believes the request is same-origin and reads the response.

Affected versions

[email protected] (PR #32084) through [email protected]. 3.x is not affected.

Reproduction

npx nuxt dev
curl -s http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json
# {"workspace":{"uuid":"...","root":"/Users/<name>/..."}}

Workaround

Set experimental: { chromeDevtoolsProjectSettings: false } in nuxt.config.ts. Chrome DevTools' Workspace auto-integration will stop working; the dev server is otherwise unaffected.

Dev-server only. Production builds do not register the route.

Two values are disclosed:

• workspace.root: the absolute filesystem path of the project (commonly reveals the OS username and the on-disk project name).
• workspace.uuid: a v4 UUID persisted to node_modules/.cache/nuxt/chrome-workspace.json, stable across dev-server restarts and re-clones.

Kodem intelligence

Fixed in [email protected] by #35201 (commit 55c75b78). The handler is now routed through the same host / origin gate the rest of the dev server uses, so the endpoint only responds to requests that look local.

1. What is GHSA-RQ7W-G337-39QQ? GHSA-RQ7W-G337-39QQ is a low-severity security vulnerability in nuxt (npm), affecting versions >= 4.0.0-alpha.1, < 4.4.7. It is fixed in 4.4.7.
2. Which versions of nuxt are affected by GHSA-RQ7W-G337-39QQ? nuxt (npm) versions >= 4.0.0-alpha.1, < 4.4.7 is affected.
3. Is there a fix for GHSA-RQ7W-G337-39QQ? Yes. GHSA-RQ7W-G337-39QQ is fixed in 4.4.7. Upgrade to this version or later.
4. Is GHSA-RQ7W-G337-39QQ exploitable, and should I be worried? Whether GHSA-RQ7W-G337-39QQ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-RQ7W-G337-39QQ is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-RQ7W-G337-39QQ? Upgrade nuxt to 4.4.7 or later.

Other vulnerabilities in nuxt