CVE-2023-3224: Code Injection in nuxt/nuxt
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.
Other sources
he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nuxtto a version that resolves this vulnerability.Fixed in 3.4.3 - Upgrade
Upgrade
nuxt/nuxtto a version that resolves this vulnerability.Fixed in 3.5.3 - Compensating control
Do not expose the Nuxt dev server publicly; only make it reachable in a trusted/internal network or behind access controls until upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3224?
CVE-2023-3224 has been classified as a high severity vulnerability due to its potential for code injection.
How do I fix CVE-2023-3224?
To mitigate CVE-2023-3224, upgrade the Nuxt framework to version 3.5.3 or later.
Which versions are affected by CVE-2023-3224?
CVE-2023-3224 affects Nuxt versions between 3.4.0 and 3.4.3.
What kind of vulnerability is CVE-2023-3224?
CVE-2023-3224 is a code injection vulnerability present in the Nuxt dev server.
Is the Nuxt dev server safe to use before upgrading against CVE-2023-3224?
It is unsafe to use the Nuxt dev server prior to upgrading because the vulnerability allows for potential code injection.