Nuxt versions 4.4.7 through 4.5.0 and 3.21.7 through 3.21.9 expose the absolute filesystem path and a persistent workspace identifier via an undocumented Chrome DevTools endpoint. The flaw resides in a header‐based gate that trusts the Host header sent by the client instead of the actual source address. Because the gateway is not protected against spoofed Host headers, an unauthenticated attacker with network reach to the development server can obtain sensitive path information and identify the project with a persistent UUID, which could facilitate further attacks such as targeted exploitation or phishing. This vulnerability is classified as CWE‑200: Information Exposure.

The affected systems are Nuxt projects running the development server natively. Versions prior to 4.5.1 of Nuxt 4 and prior to 3.21.10 of Nuxt 3 are vulnerable when the development server is bound to a machine‑reachable network interface and the experimental.chromeDevtoolsProjectSettings option is left at its default true value.

The CVSS score of 6.9 marks this flaw as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog, suggesting that no mass exploitation is reported yet. However, the attack requires the attacker to send a crafted HTTP request on the local network, a scenario that is feasible in many development environments. Once triggered, the attacker can retrieve the project’s root directory and workspace UUID without needing authentication or browser interaction. The impact is limited to information disclosure rather than code execution, but it could nevertheless aid discovery of sensitive files and inform subsequent attacks.