What is CVE-2026-71319?

CVE-2026-71319 is a critical-severity vulnerability in Nuxt Devtools, classified under Code Injection. CVSS score: 9.6/10. Published 2026-08-05.

How severe is CVE-2026-71319?

Critical severity. CVSS v3 base score is 9.6 out of 10.

RCE in Nuxt Devtools

CVE-2026-71319

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the c…

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Affected products

Nuxt Devtools — versions < 3.3.1

Weakness classification (CWE)

CWE-94 — Code Injection
CWE-306 — Missing Authentication for Critical Function

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-71319?: CVE-2026-71319 is a critical-severity vulnerability in Nuxt Devtools, classified under Code Injection. CVSS score: 9.6/10. Published 2026-08-05.
How severe is CVE-2026-71319?: Critical severity. CVSS v3 base score is 9.6 out of 10.