CRITICAL: @nuxt/devtools — Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
Impact Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws:// :…
Source @nuxt/devtoolsPublished 10d ago · Aug 5, 2026Posted on Threads
What we hold
- Package
- @nuxt/devtools
- Ecosystem
- npm
- Severity
- CRITICAL
- ID
- CVE-2026-71319
Impact Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws:// :…
Learning about advisories like this one the day they are published is a separate problem from reading them here. Dependabot alerts, the GitHub Advisory Database API, OSV.dev and npm audit, compared against live responses: how to get an alert when a dependency has a new security advisory.
More like this
HIGH: org.openidentityplatform.openam:openam-core — OpenAM Insecure SSO Cookie Initialization
Summary Description An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in…
HIGH: ansible-jailexec — Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside…
CRITICAL: codeigniter4/framework — CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations. Applications are impacted when they: - validate uploads using isimage or mimein without an independent safe…