PT-2024-25801 · Nuxt · Nuxt

Ry0Tak · Published 2024-08-05 · Updated 2026-03-12 · CVE-2024-34344

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nuxt (affected versions not specified)

Description The issue arises from insufficient validation of the path parameter in the NuxtTestComponentWrapper, allowing an attacker to execute arbitrary JavaScript on the server side. This enables the execution of arbitrary commands. Users are affected when they open a malicious web page in the browser while running the test locally, resulting in remote code execution from the malicious web page. A malicious web page can repeatedly attempt to exploit this vulnerability, triggering the exploit when the test server starts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-706

Related Identifiers

CVE-2024-34344

GHSA-V784-FJJH-F8R4

Affected Products

Nuxt

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34344.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34344 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34344 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v784-fjjh-f8r4 · Vendor Advisory
• https://github.com/nuxt/nuxt · Note
• https://github.com/nuxt/nuxt/security/advisories/GHSA-v784-fjjh-f8r4 · Note
• https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L9-L27 · Note
• https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L15-L19 · Note
• https://twitter.com/dailycve/status/2032171687299383482 · Twitter Post
• https://t.me/cvedetector/2493 · Telegram Post