This vulnerability is caused by the Nuxt development server binding its vite-node IPC server to an abstract-namespace Unix socket that is world-accessible on Linux. Unprivileged local users can connect to this socket and send requests to the module request handler, enabling them to read arbitrary files via the SSR plugin pipeline. The flaw is an example of improper access control (CWE-276) and can lead to disclosure of sensitive data such as .env files and SSH private keys. The impact is limited to local file disclosure through the development environment.

Vendors: Nuxt, Products: Nuxt. Affected versions include Nuxt 4.0.0 through 4.4.6 and Nuxt 3.18.0 through 3.21.6. Production builds are unaffected because the IPC server runs only during development.

The CVSS score of 6.8 indicates a medium severity impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not widely exploited yet. However, the attack vector is local: the attacker must have access to the same machine running the development server. The exploit requires the dev server to be running and vulnerable, but does not need network connectivity. Organizations that use shared development environments or run the dev server in production face a higher risk of exposure.