tti/tti-ux
Watch
31
1
Fork
You've already forked tti-ux
 0
Code Issues 1 Pull requests 13 Projects Releases Packages 1 Wiki Activity Actions

chore(deps): update dependency @nuxt/devtools to v3 [security] #23

Closed
renovate-bot wants to merge 1 commit from renovate/npm-nuxt-devtools-vulnerability into main
pull from: renovate/npm-nuxt-devtools-vulnerability
merge into: tti:main
Conversation 4 Commits 1 Files changed 1 +1 -1
renovate-bot commented 2026-08-06 16:46:30 +00:00
Member
Copy link

This PR contains the following updates:

Package Change Age Confidence
@nuxt/devtools (source) ^2.0.0 → ^3.0.0 age confidence

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

CVE-2026-71319 / GHSA-279x-mwfv-vcqv

More information

Details

Impact

Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://<host>:<port>/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use.

openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '<command>' }) then openInEditor('<any-existing-file>') to execute an arbitrary program on the developer's machine.

The HMR port is reachable by a process on the same host, by any peer on the LAN when the dev server is bound with nuxi dev --host, or by a malicious website the developer visits while the dev server is running (a browser can open the HMR WebSocket cross-origin). Impact is limited to development environments; production builds do not run DevTools.

Patches

Fixed in @nuxt/devtools@3.3.1. Because nuxt depends on @nuxt/devtools through a ^3.x range, updating is a lockfile refresh / reinstall; no nuxt release is required.

Workarounds
  • Update @nuxt/devtools to a patched version.
  • Do not run the dev server bound to a non-loopback interface (nuxi dev --host) on an untrusted network.
  • Disable DevTools entirely with devtools: { enabled: false } in nuxt.config.
References

Severity

  • CVSS Score: 9.6 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

❗ Important

Release Notes retrieval for this PR were skipped because no github.com credentials were available.
If you are self-hosted, please see this instruction.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@nuxt/devtools](https://devtools.nuxt.com) ([source](https://github.com/nuxt/devtools/tree/HEAD/packages/devtools)) | [`^2.0.0` → `^3.0.0`](https://renovatebot.com/diffs/npm/@nuxt%2fdevtools/2.7.0/3.3.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@nuxt%2fdevtools/3.3.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@nuxt%2fdevtools/2.7.0/3.3.1?slim=true) | --- ### Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host [CVE-2026-71319](https://nvd.nist.gov/vuln/detail/CVE-2026-71319) / [GHSA-279x-mwfv-vcqv](https://github.com/advisories/GHSA-279x-mwfv-vcqv) <details> <summary>More information</summary> #### Details ##### Impact Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the `nuxt:devtools:rpc` plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (`ws://<host>:<port>/`, subprotocol `vite-hmr`) can call RPC methods, with no token, handshake, or origin check before the channel is established. The `updateOptions()`, `clearOptions()`, and `openInEditor()` methods do not enforce the `ensureDevAuthToken` check that the other mutating methods use. `openInEditor()` reads the persisted `behavior.openInEditor` value and passes it to the `launch-editor` package, which spawns it as a child process. That value is settable through the equally unauthenticated `updateOptions()`. An attacker who can reach the HMR port can therefore chain `updateOptions('behavior', { openInEditor: '<command>' })` then `openInEditor('<any-existing-file>')` to execute an arbitrary program on the developer's machine. The HMR port is reachable by a process on the same host, by any peer on the LAN when the dev server is bound with `nuxi dev --host`, or by a malicious website the developer visits while the dev server is running (a browser can open the HMR WebSocket cross-origin). Impact is limited to development environments; production builds do not run DevTools. ##### Patches Fixed in `@nuxt/devtools@3.3.1`. Because `nuxt` depends on `@nuxt/devtools` through a `^3.x` range, updating is a lockfile refresh / reinstall; no `nuxt` release is required. ##### Workarounds - Update `@nuxt/devtools` to a patched version. - Do not run the dev server bound to a non-loopback interface (`nuxi dev --host`) on an untrusted network. - Disable DevTools entirely with `devtools: { enabled: false }` in `nuxt.config`. ##### References - GHSA-279x-mwfv-vcqv - `launch-editor`: https://www.npmjs.com/package/launch-editor #### Severity - CVSS Score: 9.6 / 10 (Critical) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` #### References - [https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv](https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv) - [https://github.com/nuxt/nuxt](https://github.com/nuxt/nuxt) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-279x-mwfv-vcqv) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> > :exclamation: **Important** > > Release Notes retrieval for this PR were skipped because no github.com credentials were available. > If you are self-hosted, please see [this instruction](https://github.com/renovatebot/renovate/blob/master/docs/usage/examples/self-hosting.md#githubcom-token-for-release-notes). --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzguMiIsInVwZGF0ZWRJblZlciI6IjQzLjI3OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eS92dWxuIl19-->
chore(deps): update dependency @nuxt/devtools to v3 [security]
Some checks failed
renovate/artifacts Artifact file update failure
ai-review / review (pull_request) Successful in 2m26s
Details
baseline-security / baseline (push) Failing after 1m20s
Details
baseline-security / baseline (pull_request) Failing after 1m45s
Details
scan / trivy-fs (push) Failing after 1m10s
Details
scan / trivy-fs (pull_request) Failing after 1m10s
Details
2fc57b32a0
renovate-bot commented 2026-08-06 16:46:35 +00:00
Author
Member
Copy link

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
undefined
### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: package-lock.json ``` undefined ```
ai-review-bot reviewed 2026-08-06 17:04:18 +00:00
ai-review-bot left a comment
Copy link

AI review · advisory

Verdict: nothing confirmed — a couple of single-reviewer observations below.

⚑ panel: GPT-OSS 120B · Gemma 4 31B · Devstral 2 123B · Laguna S 2.1 — 1 distinct, 0 confirmed, 0 refuted · web: not used · context: 1 files · 90 codebase · 14 standards chunks (best-grounded: GPT-OSS 120B; smaller windows saw less)

Panel debate — how this review was reached

Grounding — context: 1 files · 90 codebase · 14 standards chunks (best-grounded: GPT-OSS 120B; smaller windows saw less)

Round 1 — independent reviews

  • GPT-OSS 120B (0 findings, confidence 0.98): The only change updates @nuxt/devtools from ^2.0.0 to ^3.0.0, which aligns with the Nuxt 4 ecosystem and introduces no apparent bugs or policy violations.
  • Gemma 4 31B (0 findings, confidence 1.0): The diff is a routine dependency update for @nuxt/devtools to address security concerns and is correct.
  • Devstral 2 123B (1 finding, confidence 0.8): The PR updates @nuxt/devtools to v3, which is a security update. However, the version pinning should be more specific to ensure the exact version with the security fix is installed.
  • Laguna S 2.1 (0 findings):

Round 2 — cross-examination

  • Devstral 2 123B#1 Version pinning for @nuxt/devtools should use a specific version · confirmed: — · refuted: Gemma 4 31B, Laguna S 2.1

Synthesis — Devstral 2 123B wrote the final review from 0 confirmed findings (+1 unconfirmed).

Transcript rv-20260806170302-ed264f — full round outputs, web results, and model reasoning are viewable by anyone with access to this repository via the AI gateway.

Advisory — never a merge gate. Disagree with a finding? Reply on it, or use the finding board under this review. Transcript rv-20260806170302-ed264f.

### AI review · advisory **Verdict: nothing confirmed** — a couple of single-reviewer observations below. <sub>⚑ panel: GPT-OSS 120B · Gemma 4 31B · Devstral 2 123B · Laguna S 2.1 — 1 distinct, 0 confirmed, 0 refuted · web: not used · context: 1 files · 90 codebase · 14 standards chunks (best-grounded: GPT-OSS 120B; smaller windows saw less)</sub> <details> <summary>Panel debate — how this review was reached</summary> **Grounding** — context: 1 files · 90 codebase · 14 standards chunks (best-grounded: GPT-OSS 120B; smaller windows saw less) **Round 1 — independent reviews** - **GPT-OSS 120B** (0 findings, confidence 0.98): The only change updates @nuxt/devtools from ^2.0.0 to ^3.0.0, which aligns with the Nuxt 4 ecosystem and introduces no apparent bugs or policy violations. - **Gemma 4 31B** (0 findings, confidence 1.0): The diff is a routine dependency update for @nuxt/devtools to address security concerns and is correct. - **Devstral 2 123B** (1 finding, confidence 0.8): The PR updates @nuxt/devtools to v3, which is a security update. However, the version pinning should be more specific to ensure the exact version with the security fix is installed. - **Laguna S 2.1** (0 findings): **Round 2 — cross-examination** - `Devstral 2 123B#1` Version pinning for @nuxt/devtools should use a specific version · confirmed: — · refuted: Gemma 4 31B, Laguna S 2.1 **Synthesis** — Devstral 2 123B wrote the final review from 0 confirmed findings (+1 unconfirmed). <sub>Transcript `rv-20260806170302-ed264f` — full round outputs, web results, and model reasoning are viewable by anyone with access to this repository via the AI gateway.</sub> </details> <sub>Advisory — never a merge gate. Disagree with a finding? Reply on it, or use the finding board under this review. Transcript `rv-20260806170302-ed264f`.</sub>
package.json
@ -83,3 +83,3 @@
"@fontsource/public-sans": "^5.2.7",
"@fontsource/work-sans": "^5.2.8",
"@nuxt/devtools": "^2.0.0",
"@nuxt/devtools": "^3.0.0",
ai-review-bot commented 2026-08-06 17:04:18 +00:00
Member
Copy link

package.json:85 · LOW — version pinning for @nuxt/devtools should use a specific version
The version pinning for @nuxt/devtools uses a caret (^) which allows minor version updates, but the PR title indicates a security update. Security updates should pin to a specific version to ensure the exact version with the security fix is installed.

Fix: Change the version pinning from "^3.0.0" to "3.0.0" to ensure the exact version with the security fix is installed.

panel tally 1/4 · reply here or use the finding board to agree/disagree

**`package.json:85`** · LOW — version pinning for @nuxt/devtools should use a specific version The version pinning for @nuxt/devtools uses a caret (^) which allows minor version updates, but the PR title indicates a security update. Security updates should pin to a specific version to ensure the exact version with the security fix is installed. > **Fix:** Change the version pinning from `"^3.0.0"` to `"3.0.0"` to ensure the exact version with the security fix is installed. <sub>panel tally 1/4 · reply here or use the finding board to agree/disagree</sub> <!-- tti-rv:rv-20260806170302-ed264f:Devstral 2 123B#1 -->
A-Guevara commented 2026-08-12 16:21:14 +00:00
Owner
Copy link

Superseded by #29. This PR was a pre-2026-08-06 Renovate artifact: it bumped package.json but could not rewrite the lockfile (the github.com toolchain artifactError fixed by our own Renovate image, forgejo-stack PR #36) — merging it as-is would have desynced the lockfile.

Superseded by #29. This PR was a pre-2026-08-06 Renovate artifact: it bumped package.json but could not rewrite the lockfile (the github.com toolchain artifactError fixed by our own Renovate image, forgejo-stack PR #36) — merging it as-is would have desynced the lockfile.
A-Guevara closed this pull request 2026-08-12 16:21:15 +00:00
renovate-bot commented 2026-08-13 05:15:45 +00:00
Author
Member
Copy link

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 3.x releases. But if you manually upgrade to 3.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

### Renovate Ignore Notification Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for *any* future `3.x` releases. But if you manually upgrade to `3.x` then Renovate will re-enable `minor` and `patch` updates automatically. If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.
Some checks failed
renovate/artifacts Artifact file update failure
ai-review / review (pull_request) Successful in 2m26s
Details
baseline-security / baseline (push) Failing after 1m20s
Details
baseline-security / baseline (pull_request) Failing after 1m45s
Required
Details
scan / trivy-fs (push) Failing after 1m10s
Details
scan / trivy-fs (pull_request) Failing after 1m10s
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
idea
Feature suggestion — shows on the repo's Ideas tab

  
points
1
 Estimate: 1 point

  
points
13
 Estimate: 13 points

  
points
2
 Estimate: 2 points

  
points
3
 Estimate: 3 points

  
points
5
 Estimate: 5 points

  
points
8
 Estimate: 8 points

  
priority
p0
 Drop everything

  
priority
p1
 High

  
priority
p2
 Medium

  
priority
p3
 Low

  
state
blocked
 Blocked — see dependencies

  
state
done
 Complete

  
state
in-progress
 Being worked

  
state
ready
 Ready to start

  
state
review
 In review

  
state
triage
 Needs triage

  
status
declined
 Not planned — see the closing comment

  
status
in-progress
 Actively being built

  
status
planned
 Accepted — on the roadmap

  
status
proposed
 New suggestion, not yet reviewed

  
status
shipped
 Delivered

  
status
under-review
 Being evaluated by maintainers

  
type
bug
 Defect in existing behaviour

  
type
epic
 Large body of work spanning multiple stories

  
type
feature
 Shippable capability under an epic

  
type
spike
 Time-boxed investigation / research

  
type
story
 User-facing increment, points-estimated

  
type
task
 Implementation unit under a story

No labels
idea
points
1
points
13
points
2
points
3
points
5
points
8
priority
p0
priority
p1
priority
p2
priority
p3
state
blocked
state
done
state
in-progress
state
ready
state
review
state
triage
status
declined
status
in-progress
status
planned
status
proposed
status
shipped
status
under-review
type
bug
type
epic
type
feature
type
spike
type
story
type
task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
A-Guevara
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
tti/tti-ux!23
No description provided.