CVE-2025-52662

A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

CVSS v3 6.9 MEDIUM

6.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/nuxt/devtools/commit/7cadbbe9	Patch
https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nuxt:devtools:*:*:*:*:*:*:*:*

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en Nuxt DevTools ha sido corregida en la versión 2.6.4. Este problema podría haber permitido la extracción de tokens de autenticación de Nuxt a través de XSS bajo ciertas configuraciones. Se recomienda a todos los usuarios que actualicen. Más detalles: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

Information

Published : 2025-11-07 01:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-52662

Mitre link : CVE-2025-52662

CVE.ORG link : CVE-2025-52662

JSON object : View

Products Affected

nuxt

devtools

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-52662", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-52662", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-07T18:37:52.258761Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Vercel", "product": "Nuxt Devtools", "versions": [{"status": "affected", "version": "2.6.3", "versionType": "semver", "lessThanOrEqual": "2.6.3"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-07T01:15:36.803", "references": [{"url": "https://github.com/nuxt/devtools/commit/7cadbbe9", "tags": ["Patch"], "source": "support@hackerone.com"}, {"url": "https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools", "tags": ["Exploit", "Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.\r\n\r\nMore details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools"}, {"lang": "es", "value": "Una vulnerabilidad en Nuxt DevTools ha sido corregida en la versi\u00f3n 2.6.4. Este problema podr\u00eda haber permitido la extracci\u00f3n de tokens de autenticaci\u00f3n de Nuxt a trav\u00e9s de XSS bajo ciertas configuraciones. Se recomienda a todos los usuarios que actualicen.\n\nM\u00e1s detalles: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools"}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nuxt:devtools:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F278FB41-9D03-4D9B-A487-441C058EAD9C", "versionEndExcluding": "2.6.4"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}