Nuxt DevTools, a development-only component of the Nuxt Vue.js framework, exposes a WebSocket‑based RPC channel without authentication. The RPC methods updateOptions, clearOptions, and openInEditor do not enforce an authentication check. An attacker who can reach the Vite hot‑module replacement endpoint can set the openInEditor configuration to an arbitrary command via updateOptions and then trigger openInEditor on any existing file. This causes the launch‑editor package to spawn a child process, allowing the attacker to execute arbitrary code on the developer’s host. The flaw is a classic code injection (CWE‑94) combined with missing authentication (CWE‑306).

The vulnerability affects Nuxt DevTools bundled with Nuxt versions prior to 3.3.1. Any deployment of the devtools package that has not been patched to version 3.3.1 or later is vulnerable. The issue is confined to development environments where the devtools WebSocket endpoint is reachable.

The CVSS score of 9.6 classifies the flaw as critical. Although no EPSS score is published, the lack of authentication and open network exposure make exploitation highly feasible in a development context. The vulnerability is not yet listed in CISA’s KEV catalog, but its impact remains severe if a developer’s machine is compromised. Attackers require network access to the development server’s WebSocket port and the ability to send RPC payloads, which is typically possible from any machine that can reach the developer’s local network or the exposed devserver.