CVE-2026-56301: nuxt — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-56301

CVSS 5.5 · Medium EPSS 0,15%

Kerentanan Incorrect Default Permissions pada nuxt. Skor CVSS 3.1 5.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.

Rincian

Terbit di NVD: 23 Juni 2026
Terakhir diubah: 25 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-276: Incorrect Default Permissions
EPSS (30 hari): 0,15% peluang dieksploitasi; lebih tinggi dari 3,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nuxt	nuxt	Versi 3.18.0 hingga sebelum 3.21.7
nuxt	nuxt	Versi 4.0.0 hingga sebelum 4.4.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9bee872bb8d35246f25ae5 patch
https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559bff4a1f592f99063c9ea patch
https://github.com/nuxt/nuxt/security/advisories/GHSA-534h-c3cw-v3h9 advisory pihak ketiga
https://www.vulncheck.com/advisories/nuxt-arbitrary-file-read-via-world-connectable-vite-node-ipc-socket-on-li... advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.