CVE-2024-34344: Nuxt Remote Code Execution Vulnerability
Summary
CVE-2024-34344: Nuxt vulnerable to remote code execution via the browser when running the test locally. Affects nuxt versions >= 3.4.0, < 3.12.4. Fixed in 3.12.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nuxt is an open-source framework for creating Vue.js applications. It provides a powerful development environment and server-side rendering capabilities. The vulnerability in Nuxt allows for remote code execution via the browser when running tests locally.
Vulnerability Detail
The vulnerability arises from insufficient validation of the path parameter in the NuxtTestComponentWrapper. This component loads the specified path as a component and renders it. While there is some validation to prevent path traversal, it is not sufficient. By exploiting this, an attacker can execute arbitrary JavaScript on the server side, leading to the execution of arbitrary commands. The vulnerability can be triggered by opening a malicious web page in the browser while running the test locally.
How To Fix
Latest published version: 4.6.2 as of 22 Oct 2026
npm install nuxt@4.6.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.12.4
This is the first release that contains the fix.
npm install nuxt@3.12.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Nuxt to mitigate the risk of remote code execution.
Conclusion
The Nuxt Remote Code Execution vulnerability allows for the execution of arbitrary JavaScript on the server side when running tests locally. It is essential to update to Nuxt version 3.12.4 or later to prevent the exploitation of this vulnerability.
See every vulnerability recorded for nuxt →
FAQ
Nuxt is an open-source framework for creating Vue.js applications. It provides a development environment and server-side rendering capabilities.
The vulnerability arises from insufficient validation of the path parameter in the NuxtTestComponentWrapper, allowing for the execution of arbitrary JavaScript on the server side.
The vulnerability allows an attacker to execute arbitrary commands on the server side, potentially leading to unauthorized access, data breaches, or other malicious activities.
To fix this vulnerability, update to Nuxt version 3.12.4 or later, which includes the necessary validation improvements.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Nuxt to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for nuxt.
