CVE-2024-23657

CVE-2024-23657 is a critical path traversal vulnerability affecting Nuxt Devtools, an open-source framework for Vue.js applications. An attacker can exploit a missing authentication on the getTextAssetContent RPC function, combined with a lack of Origin checks on the WebSocket handler, to exfiltrate data from a locally running devtools instance. This can lead to arbitrary file reading and, in certain configurations, remote code execution (RCE) by leveraging the devtools authentication token. The vulnerability has a CVSS score of 8.8 (High) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion, but users are advised to upgrade to version 1.3.9 immediately as no workarounds exist.