CVE-2026-49993

Katalog CVE

CVSS 5.7 · Medium EPSS 0,31%

Kerentanan Exposed Dangerous Method or Function pada nuxt/rspack-builder, nuxt/webpack-builder. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.

Rincian

Terbit di NVD

12 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-749: Exposed Dangerous Method or Function

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g exploit · mitigasi · patch · advisory vendor
• https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5 exploit · mitigasi · patch · advisory vendor
• https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05 patch
• https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3 patch
• https://github.com/nuxt/nuxt/pull/35200 issue tracking